Vulnerability · Published Aug 25, 2023 · Assigned by GitHub_M
CVE-2023-40571weblogic-framework Deserialization of Untrusted Data vulnerability
Critical 9.8
In plain English
A critical-severity unsafe deserialization in weblogic-framework from dream0x01. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Official description
weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-framework gets the command echo, it directly deserializes the data returned by the server without verifying it. At the same time, the classloader loads a lot of deserialization calls. In this case, the malicious serialized data returned by the server will cause remote code execution. Version 0.2.4 contains a patch for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dream0x01 | weblogic-framework | < 0.2.4 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H