CVE-2015-4852
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
Description
CVE-2015-4852 is a critical-severity deserialization of untrusted data vulnerability in Oracle WebLogic Server. The WLS Security component allows remote attackers to execute arbitrary commands by sending a crafted serialized Java object via T3 protocol traffic to TCP port 7001, exploiting the Apache Commons Collections library bundled with WebLogic. Affected versions include Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0. CISA has added CVE-2015-4852 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 92.72% (99.8th percentile), this deserialization vulnerability has a near-certain probability of exploitation and remains one of the most targeted WebLogic flaws.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | virtual desktop infrastructure | <= 3.5.2 |
| oracle | storagetek tape analytics sw tool | 2.3 |
| oracle | weblogic server | 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0; 12.2.1.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/(Exploit)
- http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2015/11/17/19(Mailing List, Third Party Advisory)
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html(Patch)
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html(Patch, Vendor Advisory)
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html(Patch, Vendor Advisory)
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html(Patch, Vendor Advisory)
- http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html(Vendor Advisory)
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/77539(Broken Link)
- http://www.securitytracker.com/id/1038292(Broken Link)
- https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852(Broken Link)
- https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py(Product)
- https://www.exploit-db.com/exploits/42806/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46628/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application deserializes data from an untrusted source without proper validation, enabling attackers to manipulate serialized objects to execute arbitrary code. In CVE-2015-4852, Oracle WebLogic Server deserializes Java objects received via the T3 protocol without verifying their content, allowing exploitation through malicious Apache Commons Collections gadget chains.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2015-4852 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting maximum exploitability and severe impact. The vulnerability is remotely exploitable over the network without physical access, requires low attack complexity with no special conditions needed, and demands no authentication or user interaction to trigger. Confidentiality (High): An attacker can read any data accessible to the WebLogic Server process, including application data, database credentials stored in JNDI, and configuration files. Integrity (High): Successful exploitation allows arbitrary command execution on the server, enabling attackers to modify data, deploy malicious web applications, or alter server configurations. Availability (High): Attackers can shut down WebLogic Server instances, consume system resources, or render deployed applications unavailable. The EPSS score of 92.72% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity across the internet.
Exploit Maturity
CVE-2015-4852 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available from multiple sources, including the original research writeup from FoxGlove Security and exploit code on Packet Storm Security, Exploit-DB #42806, and Exploit-DB #46628. The EPSS score of 92.72% indicates near-certain exploitation activity, and this vulnerability has become a foundational reference for Java deserialization attacks across multiple enterprise platforms. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released multiple patches addressing this vulnerability, including via the January 2016, October 2016, April 2017, October 2017, and January 2018 Critical Patch Updates.
- Verify that all instances of Oracle WebLogic Server (versions 10.3.6.0.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0), Oracle Virtual Desktop Infrastructure (through 3.5.2), and Oracle StorageTek Tape Analytics SW Tool (2.3) have been updated to patched versions.
- Restrict access to the T3 protocol on TCP port 7001 using firewall rules and network segmentation. Configure WebLogic Server to use connection filters to block T3 connections from untrusted networks while allowing HTTP/HTTPS traffic.
- Monitor T3 protocol traffic for anomalous serialized Java objects, particularly those containing Apache Commons Collections gadget chain signatures. Review WebLogic Server logs for unexpected process execution or class loading activity.
- Replace the vulnerable Apache Commons Collections library (com.bea.core.apache.commons.collections.jar) with a patched version that includes deserialization safeguards. Implement JEP 290 deserialization filtering on the JVM level to restrict which classes can be deserialized.
Technical Details
CVE-2015-4852 resides in the WLS Security component of Oracle WebLogic Server and exploits insecure Java deserialization through the T3 protocol on TCP port 7001. The root cause is the inclusion of the Apache Commons Collections library (oracle_common/modules/com.bea.core.apache.commons.collections.jar), which contains "gadget classes" that can be chained together during deserialization to achieve arbitrary code execution. When a serialized Java object containing a malicious InvokerTransformer chain is sent via T3, WebLogic deserializes it without validation, triggering the gadget chain and executing arbitrary operating system commands in the context of the WebLogic Server process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial exploitation from any network position without credentials, resulting in complete server compromise.
Frequently Asked Questions
Is CVE-2015-4852 being actively exploited?
Yes. CVE-2015-4852 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 92.72% (99.8th percentile) places it among the most actively targeted vulnerabilities. No known ransomware campaigns are currently specifically associated with this vulnerability.
What products are affected by CVE-2015-4852?
CVE-2015-4852 affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.2.0.0, 12.1.3.0.0, and 12.2.1.0.0. Additionally affected are Oracle Virtual Desktop Infrastructure (through version 3.5.2) and Oracle StorageTek Tape Analytics SW Tool (version 2.3).
How do I fix CVE-2015-4852?
Apply Oracle's Critical Patch Update immediately, specifically the January 2016 CPU or later. Upgrade all WebLogic Server instances to patched versions. If immediate patching is not possible, restrict T3 protocol access on port 7001 to trusted networks and implement deserialization filtering.
How severe is CVE-2015-4852?
CVE-2015-4852 has a CVSS 3.1 score of 9.8 (CRITICAL), the near-maximum severity rating. This was a groundbreaking vulnerability that exposed the systemic risk of Java deserialization across enterprise platforms. With an EPSS score in the 99.8th percentile and multiple publicly available exploits, immediate remediation is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.