Exploitation Summary
EIP tracks 2 public exploits for CVE-2008-4008.
PoCs published by Metasploit, including Metasploit module exploits/windows/http/bea_weblogic_transfer_encoding.
AI-analyzed exploit summary This exploit targets a stack-based buffer overflow in the BEA Weblogic Apache plugin via a malformed Transfer-Encoding header. It uses SEH overwrites and a reverse shell payload to achieve remote code execution.
Description
Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
Exploits (2)
This exploit targets a stack-based buffer overflow in the BEA Weblogic Apache plugin via a malformed Transfer-Encoding header. It uses SEH overwrites and a reverse shell payload to achieve remote code execution.
This Metasploit module exploits a stack-based buffer overflow in the BEA WebLogic Apache plugin via a malformed Transfer-Encoding header. It uses SEH overwrites and a reverse shell payload to achieve remote code execution on Windows systems.