WebLogic Node Manager Command Execution

Oracle WebLogic Server is enterprise level application server for building and deploying enterprise Java EE applications. Node Manager is one of the Oracle WebLogic Server utilities to start, stop and restart administration and managed Server Instances from remote location. Node Manager is optional component of the management system.

There are two versions of Node Manager - Java-based and Script-based. Both of them are using TCP Port 5556 as the default listening port. However, the default installation of the Node Manager accepts commands only from the local host. This decreases the risk of the server being attacked.

The Node Manager is designed to accept remote commands, for example:

HELLO

GETLOG

DOMAIN

GETNMLOG

GETSTATES

EXECSCRIPT

UPDATEPROPS

The EXECSCRIPT command can execute scripts in the target server. The default location of the scripts is:

C:beawlserver_10.3samplesdomainsDOMAINbinservice-migration

A command execution vulnerability exists in Oracle WebLogic Server's Node Manager utility. The vulnerability is due to insufficient access control when a client accesses the Node Manager utility through TCP port 5556. Specifically, the EXECSCRIPT command is exposed to the client pre-authentication. In addition, the vulnerable application does not validate the path supplied to the EXECSCRIPT command and may therefore execute commands or scripts outside of the default directory if the command path includes the directory traversal chraracters like "../". A remote unauthenticated attacker can leverage this vulnerability to execute the following command by sending a crafted message to the vulnerable applications.

EXECSCRIPT ../../../../../../../../Windows/System32/notepad.exe

SonicWall has release an IPS signature to detect and block generic attack attempts targeting this vulnerability. The following signature has been released:

This vulnerability has not been assigned a Common Vulnerabilities and Exposures (CVE) identifier.