Loading vulnerability…
CVE-2018-2894 is an easily exploitable vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware, specifically the WLS - Web Services subcomponent. Affected supported versions are 12.1.3.0, 12.2.1.2, and 12.2.1.3. The flaw can be exploited by an unauthenticated attacker with network access over HTTP, allowing compromise of the target WebLogic Server instance. Specific details about the vulnerable function or code path are not available in the provided information, but the issue is described as enabling full server takeover.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python exploit script (cve-2018-2894.py) targeting Oracle WebLogic Server's arbitrary file upload vulnerability (CVE-2018-2894). The exploit works by reading a list of target URLs/IPs from 'weblogic_ip1.txt', then attempting to upload a JSP webshell (cat.jsp) to a writable directory on each target using a directory traversal attack against the /ws_utc/resources/ws/config/import endpoint. If the upload is successful, the script accesses the webshell at /console/framework/skins/wlsconsole/images/_cat.jsp and executes the 'whoami' command, printing the result. Vulnerable targets are logged to 'havebigin3.txt'. The repository also includes a README.md with usage instructions and references, and an empty 'weblogic_ip1.txt' file for input. The exploit is operational and provides a working webshell payload for remote command execution.
This repository contains a Python exploit script (CVE-2018-2894.py) targeting Oracle WebLogic Server's CVE-2018-2894 vulnerability, which allows unauthenticated attackers to upload arbitrary files (such as JSP webshells) via the /ws_utc/ endpoints. The script works by first determining the server's working directory, then manipulating the upload path, and finally uploading a test JSP file (360sglab.jsp) to a predictable location. If successful, the script confirms the presence of the uploaded file, demonstrating the vulnerability and the potential for remote code execution. The repository also includes a brief README describing the exploit's purpose. The main attack vector is network-based, exploiting HTTP endpoints exposed by the vulnerable WebLogic server.
This repository provides a working exploit for CVE-2018-2894, an arbitrary file upload vulnerability in Oracle WebLogic Server's Web Service Test Page. The main exploit script (CVE-2018-2894.py) is a Python tool that automates the exploitation process: it queries the current work directory, sets a new upload path to a web-accessible directory, and uploads a JSP webshell. The webshell allows arbitrary command execution via HTTP POST requests. The README.md provides detailed background, usage instructions, and example requests/responses, including the necessary configuration steps for the vulnerable WebLogic environment. The exploit targets the /ws_utc/resources/setting endpoints and ultimately provides a persistent webshell at a predictable location. The repository is operational and contains all necessary code and documentation for successful exploitation.
This repository is a multi-purpose Python-based network scanner and vulnerability detection toolkit, primarily targeting Windows environments but with some cross-platform capabilities. The main script, 'Ladon.py', acts as a dispatcher and scanner, supporting multiple scanning and detection modules: - 'CVE-2018-2894.py' checks for a Java deserialization vulnerability in Oracle WebLogic servers by probing a specific HTTP endpoint. - 'PhpStudyPoc.py' detects the PhpStudyDoor backdoor by sending crafted HTTP requests to various endpoints on the target. - 'SmbGhostPoc.py' is a scanner for SMBGhost (CVE-2020-0796) and SMBleed (CVE-2020-1206) vulnerabilities in the SMBv3 protocol on Windows systems. - 'Ladon.py' provides a command-line interface to scan for online hosts, enumerate SMB versions, detect MS17-010 (EternalBlue) vulnerabilities, retrieve hostnames, and invoke the above POC modules. It uses multi-threading for network scanning and can load a DLL for advanced scanning on Windows. - 'mysmb.py' is a helper library for SMB protocol operations, used by the main scanner and exploit modules. The toolkit is operational and can be used to detect the presence of several high-profile vulnerabilities (MS17-010, SMBGhost, SMBleed, WebLogic deserialization, PhpStudyDoor) and to gather information about networked Windows hosts. It does not provide weaponized exploitation or post-exploitation payloads, but rather focuses on detection and enumeration. The code is modular, with each vulnerability check implemented as a separate script or function, and the main 'Ladon.py' script orchestrates their use based on user input. The repository is suitable for penetration testers and red teamers conducting vulnerability assessments in Windows-heavy environments.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability targeted by SpeakUp to execute its malicious script (product not specified in the content).
A vulnerability targeted by SpeakUp to enable execution (product not specified in the provided content).
A vulnerability targeted by SpeakUp for execution (as referenced in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.