Oracle HTTP & WebLogic Servers Proxy Plug-in Authentication Bypass

Oracle HTTP & WebLogic Proxy Plug-in
Auth Bypass (CVE-2026-21962)

OVERVIEW

The SonicWall Capture Labs threat research team became aware of an unauthenticated authentication bypass vulnerability in Oracle HTTP & WebLogic Servers, assessed its impact and developed mitigation measures. Oracle HTTP Server (OHS) and Oracle WebLogic Server are foundational middleware components used together to deliver, secure, and scale enterprise web applications. OHS acts as the outer web server that faces the public, while WebLogic serves as the inner application server that executes the core business logic.

The issue, tracked as CVE-2026-21962, affects all versions up to and including 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 for Apache HTTP Servers as well as 12.2.1.4.0 for IIS servers and has been added to the CISA-KEV catalog. This flaw, categorized under CWE-284 (Improper Access Control), allows an unauthenticated remote attacker to achieve remote code execution via directory traversal or code injection. It carries a critical CVSS score of 10.0. As OHS continues to gain popularity and broader adoption, the risk associated with this vulnerability increases significantly. Users are strongly encouraged to apply the vendor-provided updates without delay.

TECHNICAL OVERVIEW

Oracle HTTP Server (OHS) is an enterprise web server built on the Apache HTTP Server codebase. It integrates natively into the Oracle Fusion Middleware stack to provide edge-routing, high availability, and authentication proxy layers.

Figure 1 illustrates the overall OHS architecture, including the crucial role of the trustworthy Proxy Plug-in. OHS acts as a reverse proxy residing inside a DMZ (Demilitarized Zone). The Proxy Plug-in plays the role of isolating traffic. The Proxy Plug-in bridges the DMZ to the private internal network. It intercepts public HTTP requests, validates them against edge firewall/routing rules, and securely relays them down to the backend WebLogic Server via a dedicated internal port. External clients never know the IP addresses or structure of the backend application cluster, unless the authentication bypass or directory traversal vulnerability, i.e., CVE-2026-21962.

ROOT CAUSE

The vulnerability stems from the unsafe Proxy Plug-in execution of user-supplied URLs. Because the Proxy Plug-in is trusted by the backend WebLogic server to act as a secure, authenticated filter, any vulnerability inside it breaks the entire safety chain. When a parsing error (such as a path traversal or integer overflow) occurs inside mod_wl_ohs.so, it tricks the plug-in into forwarding raw, unauthenticated requests straight into sensitive, hidden backend internal structures (like bea_wls_internal/ProxyServlet). The application server assumes the request was already vetted by the edge proxy, effectively blinding the security perimeter.

• mod_wl_ohs.so is a proxy engine binary. Due to a flaw in it, the path canonicalization failed to accurately calculate string lengths during URI rewriting when specific delimiters (e.g., ;) were used, causing an integer overflow.
• Authentication enforcement failed and allowed unauthenticated remote attackers to bypass the edge security boundary using deliberate path traversal strings.
• Due to memory isolation, a heap-based buffer overflow allows an attacker to corrupt memory boundaries using custom payload variables.

The vulnerable endpoint is within Oracle WebLogic Server: bea_wls_internal is an internal web application context deployed by default.

TRIGGERING THE VULNERABILITY

By exploiting the path normalization flaw inside the frontend proxy module (mod_wl_ohs.so or iisproxy.dll), an attacker forces the proxy to forward a request it normally would have blocked. When that request arrives at the backend WebLogic engine, it responds directly to this internal servlet. Because bea_wls_internal/ProxyServlet is designed to be a highly privileged application router for cluster management and internal proxying, gaining direct, unauthenticated access to it allows an attacker to:

• Tunnel Malicious Requests: Route arbitrary traffic deeper into the internal corporate network, effectively using the WebLogic server as an internal pivot point.
• Execute Internal Admin Functions: Access backend deployment and diagnostic utilities that are completely hidden from the public internet under normal operations.
• Achieve Remote Code Execution (RCE): Chain access with internal servlet parameters to deploy malicious web applications directly into runtime memory.

Under normal operations, the edge plug-ins (mod_wl_ohs.so or iisproxy.dll) are hardcoded to block any direct public incoming request containing the string /bea_wls_internal/ to keep it isolated. In the exploitation attempts associated with CVE-2026-21962, the URL is used via path traversal to make the frontend and backend interpret the path differently:

• A request arrives structured as /_proxy//weblogic/..;/bea_wls_internal/ProxyServlet. The OHS proxy engine encounters the trailing semicolon (..;), treats it as a non-standard delimiter parameter, strips it from its routing validation logic, and treats the request as bound for a safe, publicly allowed folder.
• Because OHS considers the destination safe, it forwards the raw string down to the backend. The Java-based WebLogic engine normalizes the path using standard directory rules where ..; acts as a true directory traversal sequence. It resolves the path backwards, reaches the root directory, and grants direct access to the internal /bea_wls_internal/ProxyServlet application endpoint without ever validating authentication.

EXPLOITATION

Successful exploitation enables a remote attacker to gain full control of the affected system via the untrusted Proxy Plug-in. Figure 3 shows a sample of a real-world proof of concept against vulnerable instances, resulting in a successful takeover of OHS and Oracle WebLogic Server via a simple URL normalization flaw using a publicly available exploit. Given the Oracle servers' extensive system privileges, this vulnerability can result in complete compromise of the operator’s machine.

SONICWALL PROTECTIONS

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

• IPS: 22419 Oracle WebLogic Server Proxy Plug-in Remote Code Execution 1
• IPS: 22420 Oracle WebLogic Server Proxy Plug-in Remote Code Execution 2
• IPS: 22421 Oracle WebLogic Server Proxy Plug-in Remote Code Execution 3
• IPS: 22422 Oracle WebLogic Server Proxy Plug-in Remote Code Execution 4
• IPS: 22423 Oracle WebLogic Server Proxy Plug-in Remote Code Execution 5

REMEDIATION RECOMMENDATIONS

With Oracle’s growing user base and increasing deployment footprint, organizations and individual users should upgrade to the latest patched version as outlined in the official vendor advisory.

RELEVANT LINKS

• Vendor Advisory
• CISA-KEV
• POC
• Patch-fix
• https://github.com/advisories/GHSA-4wp9-cf5h-v2g5