Oracle WebLogic Server Console Remote Code Execution

Small repository containing a write-up and a single Java proof-of-concept payload for exploiting the Oracle WebLogic Server CVE-2020-14882/CVE-2020-14883 chain. Structure is minimal: README.md provides the exploitation narrative, reconnaissance examples, vulnerable path pattern, and detection guidance; poc/exploit_payload.java contains the core payload logic. The exploit targets Oracle WebLogic Server 12.2.1.3 and uses a web attack path: first, an authentication bypass via double-encoded path traversal to /console.portal; second, code execution through a WebLogic/MVEL-related execution path. The Java payload is not a standalone program but a code fragment intended to run inside the vulnerable WebLogic execution context. It hijacks the current WebLogic worker thread, reflectively accesses the connection handler, obtains request/response objects, reads an attacker-controlled command from the X-CMD-HEADER header, executes it through cmd.exe or /bin/sh depending on the OS, captures stdout, and writes the output directly into the HTTP response stream. This gives the operator in-band command execution results rather than blind RCE. The repository is a real exploit PoC rather than a detector or fake sample, but it is operational rather than weaponized because it provides a hardcoded payload concept without a full delivery framework or customizable exploit tooling.

This repository contains a single Metasploit module targeting Oracle WebLogic Server's Administration Console for remote code execution (RCE) via a path traversal and Java class instantiation vulnerability. The exploit leverages crafted HTTP POST requests to the '/console/css/.%252e/console.portal' endpoint, abusing the 'handle' parameter to trigger code execution. It supports multiple payload types, including direct command execution and Meterpreter reverse shells, across Unix/Linux and Windows platforms. The module is weaponized, allowing for easy payload customization and automated exploitation. It targets CVE-2020-14882, CVE-2020-14883, and CVE-2020-14750, affecting WebLogic versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The code is structured as a standard Metasploit exploit module, with clear separation of check, exploit, and payload delivery logic. The only file present is the Ruby module itself, which is fully self-contained and ready for use within the Metasploit framework.

This repository contains a Python proof-of-concept exploit targeting Oracle WebLogic Server. The main file, 'weblogic.py', sends a crafted POST request to the '/console/images/%252E%252E%252Fconsole.portal' endpoint on the target server, attempting to exploit a vulnerability that allows remote code execution via the 'com.tangosol.coherence.mvel2.sh.ShellSession' class. The payload executes the 'ipconfig' command to fingerprint the operating system. The script checks the response for evidence of Windows OS and reports if the target is vulnerable. The README.md provides an example of a similar payload and a sample HTTP request. The exploit requires the attacker to specify the target's IP and port, and the target must be accessible over the network. No CVE is explicitly referenced, but the exploit is clearly aimed at WebLogic's remote code execution vulnerabilities.