CVE-2023-21839
Oracle WebLogic Server Unspecified Vulnerability
Description
CVE-2023-21839 is a high-severity vulnerability in Oracle WebLogic Server affecting the Core component across versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability involves deserialization of untrusted data (CWE-502) combined with missing authentication for critical functions (CWE-306), allowing an unauthenticated attacker with network access via T3 or IIOP protocols to gain unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CISA has confirmed active exploitation in the wild, and the EPSS score of 94.1% (99.9th percentile) indicates near-certain exploitation activity. Public exploit code is available, making immediate patching critical for all exposed WebLogic Server deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 |
References
- http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpujan2023.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2023-21839 involves deserialization of untrusted data in Oracle WebLogic Server, where the T3 and IIOP protocols accept and process serialized Java objects from unauthenticated remote clients. When the server deserializes attacker-crafted objects without proper validation, it can be tricked into performing unintended operations, including accessing sensitive data or executing arbitrary lookups.
Learn more: CWE-502 — Deserialization of Untrusted Data
CWE-306: Missing Authentication for Critical Function
CVE-2023-21839 also involves missing authentication for critical functions in the WebLogic Server Core component. The T3 and IIOP protocol endpoints that process the vulnerable deserialization operations do not require authentication, allowing any unauthenticated network attacker to interact with them directly and exploit the deserialization flaw without needing valid credentials.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-21839 carries a CVSS 3.1 base score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Attack Vector (Network): the vulnerability is remotely exploitable over the network via T3 or IIOP protocols without requiring physical or adjacent network access, making any internet-exposed or internally accessible WebLogic Server instance a target. Attack Complexity (Low): exploitation requires no special conditions, timing windows, or custom configurations — standard protocol connections are sufficient. Privileges Required (None): no authentication is needed to exploit the vulnerability, significantly lowering the barrier for attackers. User Interaction (None): the attack proceeds entirely without victim action. Confidentiality (High): successful exploitation grants the attacker unauthorized access to critical data or complete access to all data accessible to the WebLogic Server, which in enterprise environments often includes business-critical application data, credentials, and configuration information. Integrity and Availability (None): the vulnerability is focused on data exfiltration and does not directly enable data modification or service disruption, though the stolen data could enable further attacks.
Exploit Maturity
Public exploit code is available for CVE-2023-21839 via Packet Storm Security, providing a pre-authentication remote command execution exploit targeting the T3 protocol deserialization weakness. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2023. The EPSS score of 94.1% (99.9th percentile) indicates near-certain exploitation activity. While the ransomware usage status is listed as unknown, the combination of unauthenticated network access, public exploit availability, and the high-value target profile of WebLogic Server deployments (commonly hosting critical enterprise applications) makes CVE-2023-21839 a top-priority remediation target.
Remediation
- Apply Oracle's January 2023 Critical Patch Update immediately: Oracle has released a patch for CVE-2023-21839 in the January 2023 CPU. Refer to the Oracle Security Alert for specific patch details and installation instructions for WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0.
- Apply mitigations per CISA KEV guidance: Per the KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. The CISA remediation deadline was May 22, 2023.
- Restrict T3 and IIOP protocol access: If immediate patching is not feasible, configure network firewalls and WebLogic Server connection filters to block T3 and IIOP protocol access from untrusted networks. Limit these protocol endpoints to authorized administration hosts only.
- Deploy network segmentation: Ensure WebLogic Server instances are not directly exposed to the internet. Place them behind reverse proxies, load balancers, or application firewalls that only expose HTTP/HTTPS endpoints and block direct T3/IIOP access from external sources.
- Monitor for exploitation indicators: Review WebLogic Server access logs for unusual T3 or IIOP connection patterns, unexpected JNDI lookup requests, and anomalous data access patterns that may indicate exploitation attempts.
Technical Details
CVE-2023-21839 is a vulnerability in the Oracle WebLogic Server Core component that combines deserialization of untrusted data (CWE-502) with missing authentication for critical functions (CWE-306). Affected protocols: the vulnerability is accessible through WebLogic's T3 (proprietary) and IIOP (Internet Inter-ORB Protocol) communication protocols, which are used for Java Remote Method Invocation (RMI), administration, and inter-server communication. Root cause: the T3 and IIOP endpoints accept serialized Java objects from unauthenticated clients and process them without adequate validation. An attacker can craft a malicious serialized object that, when deserialized by the WebLogic Server, initiates a JNDI lookup to an attacker-controlled resource. This allows the attacker to extract sensitive data from the server's environment or, depending on the server configuration and available deserialization gadget chains, achieve remote code execution. Attack mechanism: the attacker establishes a T3 or IIOP connection to the WebLogic Server and sends a crafted serialized payload that triggers a lookup operation against an external resource under the attacker's control. The server processes this request without requiring authentication, as the T3/IIOP protocol handlers lack proper access controls for these operations. CVSS vector analysis: the network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N) make this trivially exploitable against any reachable WebLogic Server. The confidentiality-only impact (C:H/I:N/A:N) reflects the primary attack outcome of data exfiltration, though the Packet Storm Security exploit demonstrates that remote command execution is achievable in practice.
Frequently Asked Questions
Is CVE-2023-21839 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-21839 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2023. Public exploit code is available via Packet Storm Security, and the EPSS score of 94.1% (99.9th percentile) indicates near-certain exploitation activity. The ransomware usage status is currently unknown.
What products are affected by CVE-2023-21839?
CVE-2023-21839 affects Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability is in the Core component and is accessible via the T3 and IIOP protocols. Organizations running any of these WebLogic Server versions should apply the January 2023 Critical Patch Update.
How do I fix CVE-2023-21839?
Apply Oracle's January 2023 Critical Patch Update, which includes a patch for CVE-2023-21839. If immediate patching is not possible, restrict network access to T3 and IIOP protocol endpoints using firewall rules and WebLogic connection filters. See the Remediation section for detailed steps.
How severe is CVE-2023-21839?
CVE-2023-21839 is rated HIGH with a CVSS 3.1 base score of 7.5. The vulnerability allows unauthenticated remote attackers to access critical data via the T3 or IIOP protocols with low complexity. The EPSS score of 94.1% (99.9th percentile) and CISA KEV listing confirm this vulnerability is actively being exploited at scale.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.