Oracle WebLogic CVE-2020-14882 Exploited for Cobalt Strike and Cryptomining
Active Exploitation · 4 sources · Updated 3mo ago · First seen Oct 30, 2020
Attackers actively exploited Oracle WebLogic Server flaw CVE-2020-14882 to achieve unauthenticated remote code execution, with intrusions quickly progressing from opportunistic scanning to malware deployment. Incident reporting showed one campaign using obfuscated PowerShell to fetch a Cobalt Strike payload from 185[.]205.210.179, while another used a malicious wbw.xml file and follow-on scripts to install XMRig, rename it to sysupdate, and establish persistence with a scheduled task, driving victim CPU usage to 100%. Researchers warned the same access pattern could be readily adopted by ransomware operators because Cobalt Strike is commonly used in hands-on-keyboard attacks.
Technical analysis tied the exploitation to improper access control and path traversal in WebLogic console resources, where double URL decoding and abuse of console.portal and the handle parameter enabled code execution through MVEL and reflection. Oracle’s initial fix was found to be incomplete because blacklist-based URL filtering could be bypassed with trivial changes, leading to the related patch-bypass issue CVE-2020-14750. Defenders were urged to apply Oracle’s latest patches and hunt for indicators linked to console.portal, malicious PowerShell downloaders, miner artifacts, and published YARA, Sigma, and Suricata detections.
