Researchers Analyze Oracle WebLogic Flaw Under Attack

Trend Micro researchers explain how attackers bypassed the patch for a deserialization vulnerability in the Oracle WebLogic Server.

Dark Reading Staff, Dark Reading

May 12, 2020

1 Min Read
Dark Reading logo in a gray background | Dark Reading

Oracle recently urged customers to deploy its April 2020 Critical Patch Update to address CVE-2020-2883, a vulnerability affecting multiple versions of the Oracle WebLogic Server. Both the company and US-CERT published warnings to inform users the flaw was under active attack.

Now researchers with Trend Micro's Zero-Day Initiative (ZDI) have published an analysis of the bug. Earlier this year, a deserialization vulnerability in the Oracle WebLogic Server was patched by Oracle and assigned CVE-2020-2555. Later on, security researcher Quynh Le of VNPT ISC found a flaw showing how an attacker might bypass the first bug. The second flaw received the label CVE-2020-2883 and is now being exploited in the wild, ZDI researcher Sivathmican Sivakumaran explains.

Cybercriminals are using CVE-2020-2883 to target unpatched servers, US-CERT warns. In an analysis, Sivakumaran notes this flaw is in the Coherence library. "Any application with the Coherence library in its code path where there is a path to deserialization is also vulnerable," he states. An example is Oracle Business Intelligence, which is deployed on Oracle WebLogic.

Oracle does not mention how widespread the attacks are but emphasizes the importance of patching and offers guidance on how to restrict the T3/T3S protocol traffic for WebLogic Server. The company will release its next batch of security fixes on July 14.

Read more details about the vulnerability in Sivakumaran's blog post here.

VIRTUALSUMMIT_DR20_320x50.jpg

 

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights