WebLogic Server Deserialization Remote Code Execution
Posted by deepcore on June 5, 2020 – 5:23 pm
This Metasploit module exploits a Java object deserialization vulnerability in multiple versions of WebLogic. Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable versions of WebLogic. Leveraging an ExtractorComparator enables the ability to trigger method.invoke(), which will execute arbitrary code.
Post a reply
You must be logged in to post a comment.