Exploitation Summary
EIP tracks 6 public exploits for CVE-2020-14645. PoCs published by Y4er, Schira4396, DaBoQuan.
AI-analyzed exploit summary This PoC exploits CVE-2020-14645, a deserialization vulnerability in WebLogic, by crafting a malicious serialized object that triggers JNDI injection via an LDAP reference. The payload is sent over T3 protocol to achieve remote code execution.
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Exploits (6)
This PoC exploits CVE-2020-14645, a deserialization vulnerability in WebLogic, by crafting a malicious serialized object that triggers JNDI injection via an LDAP reference. The payload is sent over T3 protocol to achieve remote code execution.
This repository contains a Python-based exploit for CVE-2020-14645, a vulnerability in Oracle WebLogic Server. The exploit leverages JNDI injection to achieve remote code execution (RCE) by spawning a reverse shell via a crafted payload.
This repository contains a proof-of-concept exploit for CVE-2020-14645, a deserialization vulnerability in Oracle WebLogic Server. The exploit leverages JNDI injection via LDAP to achieve remote code execution by sending a malicious T3 protocol payload.
This repository contains a functional exploit for CVE-2022-21445, a Java deserialization vulnerability in Oracle ADF Faces leading to unauthenticated Remote Code Execution. The exploit generates payloads for different attack scenarios (webshell, sleep, DNS callback) and includes detailed setup instructions.
This repository contains a proof-of-concept exploit for CVE-2020-14645, a deserialization vulnerability in Oracle WebLogic Server. The exploit leverages JNDI injection via LDAP to achieve remote code execution by sending a malicious serialized payload over the T3/T3S protocol.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H