CVE-2018-2628
Oracle WebLogic Server Unspecified Vulnerability
Description
CVE-2018-2628 is a deserialization vulnerability in Oracle WebLogic Server that allows an unauthenticated attacker with T3 protocol network access to completely compromise the server. The flaw exists in the T3 protocol handler, which deserializes untrusted data from remote connections, enabling remote code execution. Oracle WebLogic Server is a widely deployed Java EE application server used in enterprise environments for hosting critical business applications, making this vulnerability a high-value target for attackers. CISA has added CVE-2018-2628 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.4% (99th percentile), exploitation is near-certain for exposed instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/103776(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040696(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/brianwrf/CVE-2018-2628(Broken Link)
- https://www.exploit-db.com/exploits/44553/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/45193/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46513/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2628(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2018-2628 exploits a deserialization of untrusted data weakness in Oracle WebLogic Server's T3 protocol implementation. The server deserializes Java objects received over T3 network connections without sufficient verification, allowing an attacker to send specially crafted serialized objects that, when deserialized, execute arbitrary code on the server. This is a well-known class of Java deserialization vulnerabilities that has affected numerous enterprise middleware products.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2018-2628 poses a critical risk to enterprise infrastructure. The vulnerability is remotely exploitable over the network via the T3 protocol without requiring any authentication, and no user interaction is needed. The attack complexity is low, as reliable exploitation techniques are well-documented and widely available. Successful exploitation results in complete compromise of the Oracle WebLogic Server, granting the attacker full control over confidentiality, integrity, and availability of the application server and all hosted applications. This can lead to exfiltration of sensitive business data, modification of application logic, deployment of web shells or backdoors, and use of the compromised server as a pivot point for lateral movement within the enterprise network. With an EPSS score of 94.4% (99th percentile), this vulnerability is among the most actively exploited in the entire CVE database.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-2628 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 29, 2022. The EPSS score of 94.4% (99th percentile) reflects near-certain exploitation activity, and multiple public exploit tools and proof-of-concept scripts are available targeting this vulnerability. The WebLogic T3 deserialization attack vector has been extensively researched and weaponized by both security researchers and threat actors, with exploit frameworks like ysoserial providing ready-to-use payloads. No specific ransomware campaigns are currently associated with this CVE, but WebLogic deserialization vulnerabilities are commonly exploited for cryptomining, web shell deployment, and data theft.
Remediation
- Apply the Oracle Critical Patch Update (CPU) for April 2018: Per the CISA KEV required action, install the patches provided in the Oracle CPU April 2018 advisory, which addresses CVE-2018-2628 in WebLogic Server.
- Restrict T3 protocol access: Configure WebLogic Server connection filters to block T3 protocol access from untrusted networks. Only allow T3 connections from trusted internal application servers that require this protocol for inter-server communication.
- Disable the T3 protocol on internet-facing interfaces: If the T3 protocol is not required on external-facing network interfaces, disable it entirely to eliminate the attack vector. Use T3S (T3 over TLS) for necessary internal communications.
- Deploy network-level controls: Implement firewall rules to restrict access to WebLogic Server ports (typically 7001/7002) from untrusted sources, and use a Web Application Firewall (WAF) to inspect and filter malicious T3 traffic.
- Implement Java deserialization filtering: Configure WebLogic's deserialization blacklist (weblogic.security.net.ConnectionFilterImpl) to block known dangerous Java classes used in deserialization attacks, and monitor for deserialization-related errors in server logs.
Technical Details
CVE-2018-2628 is a Java deserialization vulnerability in Oracle WebLogic Server's T3 protocol handler. The T3 protocol is WebLogic's proprietary protocol for communication between WebLogic Server instances and Java clients, and it natively supports Java object serialization for remote method invocation. The vulnerability exists because the T3 protocol listener deserializes incoming Java objects without adequately filtering or validating the classes being deserialized. An attacker can establish a T3 connection to the WebLogic Server and send a specially crafted serialized Java object that leverages gadget chains (sequences of existing Java classes with exploitable deserialization behavior) to achieve arbitrary code execution. The exploit typically uses classes from common libraries present on the WebLogic classpath, such as those in the Apache Commons Collections library, to construct a chain that ultimately invokes Runtime.exec() or similar methods. Since the T3 protocol operates before any application-level authentication, the attack is fully unauthenticated.
Frequently Asked Questions
Is CVE-2018-2628 being actively exploited?
Yes. CISA has added CVE-2018-2628 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.4% (99th percentile) indicates near-certain exploitation probability. Public exploit tools and PoC code are widely available. No specific ransomware campaigns are currently linked to this CVE.
What products are affected by CVE-2018-2628?
CVE-2018-2628 affects Oracle WebLogic Server. The vulnerability is present in versions prior to the April 2018 Critical Patch Update. All WebLogic Server instances with the T3 protocol accessible from untrusted networks are at risk.
How do I fix CVE-2018-2628?
Apply the Oracle Critical Patch Update for April 2018, which patches the deserialization vulnerability. Additionally, restrict T3 protocol access using WebLogic connection filters and network firewalls, allowing T3 connections only from trusted internal sources.
How severe is CVE-2018-2628?
CVE-2018-2628 is a critical severity deserialization vulnerability that enables unauthenticated remote code execution on Oracle WebLogic Server. With an EPSS score of 94.4% (99th percentile), it is among the most actively exploited vulnerabilities. Successful exploitation grants complete control over the application server and all hosted applications.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.