CVE-2019-2729
CRITICAL EXPLOITED IN THE WILD RANSOMWARE NUCLEIOracle Communications Diameter Signaling Router - Unauthenticated Remote Code Execution via HTTP
Title source: llmExploitation Summary
CVE-2019-2729 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 6 public exploits from researchers including james, ruthlezs, waffl3ss. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages CVE-2019-2729, a deserialization vulnerability in Oracle WebLogic Server, to achieve remote command execution. It generates a malicious payload using msfvenom and sends it via a crafted SOAP request to trigger the vulnerability.
Description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Exploits (6)
This exploit leverages CVE-2019-2729, a deserialization vulnerability in Oracle WebLogic Server, to achieve remote command execution. It generates a malicious payload using msfvenom and sends it via a crafted SOAP request to trigger the vulnerability.
This repository contains a functional exploit for CVE-2019-2729, a deserialization vulnerability in Oracle WebLogic Server. The exploit sends a crafted SOAP request to the vulnerable endpoint to achieve remote code execution (RCE).
This repository contains a functional exploit for CVE-2019-2729, a deserialization vulnerability in Oracle WebLogic Server. The exploit leverages crafted SOAP requests to achieve remote code execution (RCE) by embedding malicious payloads in the 'lfcmd' header.
This repository contains a functional Python-based exploit for CVE-2019-2729, a deserialization vulnerability in Oracle WebLogic Server. The PoC supports single-target exploitation, batch scanning from a file, and interactive shell access, demonstrating remote code execution (RCE) capabilities.
This repository contains a functional Python exploit for CVE-2019-2729, a WebLogic deserialization vulnerability. The exploit uses ysoserial to generate a malicious payload and crafts a SOAP request to trigger remote code execution.
This repository contains a Python-based scanner for detecting multiple WebLogic vulnerabilities, including CVE-2019-2729. It performs checks for known CVEs but does not include functional exploit code for achieving RCE or other offensive actions.
Nuclei Templates (1)
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H