CVE-2015-4852 Oracle WebLogic Server Deserialization of Untrusted Data
Remote attackers can execute arbitrary commands on Oracle WebLogic Server by sending crafted serialized Java objects via the T3 protocol.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4852?
CVE-2015-4852 is a critical unsafe deserialization vulnerability in Oracle Weblogic Server, published on 18 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
Weakness: CWE-502
Which versions are affected by CVE-2015-4852?
It affects 3 products.
Products include Oracle Storagetek Tape Analytics Sw Tool, Oracle Virtual Desktop Infrastructure, Oracle Weblogic Server.
How do I fix CVE-2015-4852?
Apply the vendor's patch. US federal agencies must fix it by 3 May 2022.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2015-4852 being exploited?
Yes. Attackers have exploited CVE-2015-4852 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 4 proofs of concept on GitHub.
Sources
Also known as GHSA-7r6v-mxc2-pg49, UBUNTU-CVE-2015-4852, USN-6936-1.