CVE-2017-3506
Oracle WebLogic Server OS Command Injection Vulnerability
Description
CVE-2017-3506 is a high-severity vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware that allows an unauthenticated attacker with network access via HTTP to compromise supported versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, and 12.2.1.2. With a CVSS v3.1 base score of 7.4, the vulnerability resides in the Web Services subcomponent and can result in unauthorized access to critical data as well as unauthorized modification capabilities. CISA has added CVE-2017-3506 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 24, 2024, and the ransomware association is currently unknown. Its EPSS score of 94.39% at the 100th percentile places it among the most actively exploited vulnerabilities globally, reflecting years of sustained weaponization against internet-facing WebLogic servers.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.0.0; 12.2.1.1.0; 12.2.1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/97884(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038296(Broken Link, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506(US Government Resource)
Weakness Type
OS Command Injection via Web Services
CVE-2017-3506 is a vulnerability in Oracle WebLogic Server's Web Services component that enables remote code execution through specially crafted HTTP requests. The weakness is rooted in improper input validation within the Web Services subsystem, specifically in the handling of XML deserialization. An attacker can craft malicious XML payloads that, when processed by the vulnerable WebLogic Server, result in operating system command execution on the underlying host. This class of vulnerability is extremely dangerous in application servers like WebLogic because they typically run with elevated privileges and serve as the backbone of enterprise Java application deployments. Learn more about improper input validation at CWE-20.
Impact Analysis
The impact of CVE-2017-3506 is severe, particularly in the confidentiality and integrity dimensions. Confidentiality is fully compromised because a successful attack grants the attacker access to all data managed by the WebLogic Server, including application databases, configuration files, cryptographic keys, and any sensitive business data processed by deployed applications. WebLogic servers commonly host mission-critical enterprise applications, making data exposure extensive.
Integrity faces maximum impact as the attacker can execute arbitrary commands on the server, enabling modification of application code, database records, configuration, and deployment artifacts. This allows for persistent backdoor installation, web shell deployment, and manipulation of business logic to serve the attacker's objectives.
While the CVSS vector indicates no direct availability impact (A:N), the practical consequences of full command execution extend well beyond the formal scoring. The high attack complexity (AC:H) reflects that specific conditions must be met for exploitation, but the absence of any privilege requirement (PR:N) and no user interaction (UI:N) means that any internet-exposed WebLogic server is a viable target. The extraordinary EPSS score of 94.39% at the 100th percentile demonstrates that this seven-year-old vulnerability remains under constant exploitation, driven by the prevalence of unpatched WebLogic servers and the availability of mature exploitation tools.
Exploit Maturity
CVE-2017-3506 has reached maximum exploit maturity with years of sustained active exploitation since its disclosure in 2017. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 24, 2024, underscoring that exploitation remains an active and ongoing concern nearly a decade after the original patch was released.
The EPSS score of 94.39% at the 100th percentile is among the highest possible, confirming that CVE-2017-3506 is consistently targeted by automated scanning and exploitation campaigns. Multiple public exploits and exploitation frameworks include modules for this vulnerability. The vulnerability has been used extensively by various threat groups, including state-sponsored actors and cybercriminal organizations targeting enterprise environments. The original Oracle Critical Patch Update from April 2017 provides the official advisory and patch information. The ransomware association remains unknown, but the remote code execution capability and prevalence of exploitation make it a high-value initial access vector for any post-exploitation campaign.
Remediation
-
Apply the Oracle Critical Patch Update immediately. Install the patch from the April 2017 Critical Patch Update or upgrade to a version that includes this fix. Given the age of the vulnerability, strongly consider upgrading to a currently supported WebLogic Server version that receives regular security updates.
-
Restrict network access to WebLogic administration and Web Services endpoints. Place WebLogic Server behind a web application firewall and restrict direct access from untrusted networks. The T3 protocol and administrative console should never be exposed to the internet. Apply network segmentation to limit which systems can reach WebLogic management ports.
-
Deploy web application firewall rules to block malicious XML payloads. Configure WAF rules to detect and block XML deserialization attacks targeting WebLogic's Web Services endpoints. Many WAF vendors provide specific rulesets for WebLogic exploitation patterns.
-
Audit WebLogic servers for signs of prior compromise. Given the long history of exploitation, any unpatched WebLogic server should be presumed compromised. Search for web shells, unauthorized deployed applications, unexpected system processes, and anomalous outbound network connections. Review server logs for exploitation signatures.
-
Implement a lifecycle plan for legacy WebLogic deployments. Versions 10.3.6.0 and 12.1.3.0 are no longer receiving security patches. Migrate applications to current WebLogic versions or alternative platforms to ensure ongoing security coverage.
Technical Details
CVE-2017-3506 is a vulnerability in Oracle WebLogic Server's Web Services component with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, resulting in a high base score of 7.4. The network attack vector (AV:N) means the vulnerability is exploitable remotely by any attacker who can reach the WebLogic Server over HTTP. The high attack complexity (AC:H) indicates that successful exploitation requires specific conditions or configurations to be present, though in practice, default WebLogic installations frequently meet these conditions.
The vulnerability exists in the Web Services subcomponent's handling of XML input. Oracle WebLogic Server's Web Services layer processes incoming SOAP requests that include serialized Java objects embedded in XML. The server fails to properly validate and sanitize these serialized objects before deserialization, allowing an attacker to inject malicious payloads that execute arbitrary operating system commands when deserialized. The attack requires no authentication (PR:N) and no user interaction (UI:N), making it fully automatable.
The scope remains unchanged (S:U), with the impact confined to the WebLogic Server process context, but since WebLogic typically runs with significant system privileges, the practical impact extends to the entire host. Confidentiality (C:H) and integrity (I:H) are fully compromised through command execution, while the formal availability impact is rated as none (A:N) because the exploit does not inherently crash the service. Affected versions include Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0.
Frequently Asked Questions
What is CVE-2017-3506?
CVE-2017-3506 is a high-severity vulnerability in Oracle WebLogic Server's Web Services subcomponent that allows an unauthenticated remote attacker to execute arbitrary commands on the server through specially crafted HTTP requests. It has a CVSS v3.1 score of 7.4 and remains actively exploited.
Why is a 2017 vulnerability still being exploited?
CVE-2017-3506 continues to be exploited because many organizations still run unpatched or legacy WebLogic Server instances. The availability of mature, reliable exploits combined with the large number of internet-exposed WebLogic servers makes this a persistently attractive target for attackers.
Which Oracle WebLogic versions are affected?
The affected versions are Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0. Organizations should apply the April 2017 Critical Patch Update or upgrade to a currently supported version.
How can I tell if my WebLogic server has been compromised through CVE-2017-3506?
Look for web shells in the WebLogic deployment directories, unauthorized deployed applications, unexpected processes running under the WebLogic user account, and anomalous outbound network connections. Review HTTP access logs for suspicious XML payloads targeting Web Services endpoints.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.