b1g-b33f/CVE-2020-14882

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that sends a crafted POST request to a WebLogic Console path traversal endpoint to achieve unauthenticated remote code execution via a ShellSession payload.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Bash script that sends a crafted POST request to a WebLogic server to test for CVE-2020-14882/14883. The script constructs a URL with a path traversal and includes a hardcoded command execution payload in the POST data. This is consistent with a proof-of-concept exploit for the stated CVE. No concealed, deceptive, or operator-directed harmful behavior beyond the advertised exploit test was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesBash
Target softwareOracle WebLogic Server
Attack typesRemote Code ExecutionAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a payload designed to execute a command on the target, which is the definition of an exploit. It does not merely check for the vulnerability; it attempts to trigger remote code execution.

cve-2020-14882.sh:10-11

Requirements

  • Target must be running a vulnerable version of Oracle WebLogic Server (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0).cve-2020-14882.sh:1-11
  • Attacker must have network access to the target WebLogic Console.cve-2020-14882.sh:1-11

Observed behavior

  • Constructs a URL using a path traversal sequence to bypass authentication on the WebLogic Console.cve-2020-14882.sh:8
  • Sends a POST request with a payload that executes an arbitrary shell command (curl) on the target server.cve-2020-14882.sh:10-11
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
curl http://x.x.x.x:80The script includes a hardcoded command to be executed on the target via the WebLogic vulnerability, which is the expected behavior of a CVE-2020-14882/14883 PoC.cve-2020-14882.sh:11
Review boundaries

What the analysis did not establish

  • The script contains a placeholder IP address (x.x.x.x) and requires modification before use, but the exploit logic is complete.
  • The evidence does not include any output or verification that the exploit was successfully executed.
  • Only the two text files (README.md and cve-2020-14882.sh) were provided and reviewed. No other files exist in the repository according to the inventory.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1