Oracle WebLogic Server Deserialization RCE

#!/usr/bin/env python3
# check_cve_2018_2893.py
# Oracle WebLogic Server CVE-2018-2893 local assessment helper
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import os
import re
import socket
import sys
import zipfile
from xml.etree import ElementTree as ET

AFFECTED = {"10.3.6.0", "10.3.6.0.0", "12.1.3.0", "12.1.3.0.0", "12.2.1.2", "12.2.1.2.0", "12.2.1.3", "12.2.1.3.0"}
UNAFFECTED_PREFIXES = ["12.2.1.4", "14."]


def norm(v):
    if not v:
        return None
    v = v.strip()
    if re.fullmatch(r"\d+\.\d+\.\d+\.\d+", v):
        return v
    if re.fullmatch(r"\d+\.\d+\.\d+\.\d+\.\d+", v):
        return v
    return v


def parse_manifest_version(jar_path):
    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            for name in ("META-INF/MANIFEST.MF", "meta-inf/manifest.mf"):
                if name in zf.namelist():
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.lower().startswith("implementation-version:"):
                            return norm(line.split(":", 1)[1].strip())
    except Exception:
        return None
    return None


def find_version_from_registry(mw_home):
    candidates = [
        os.path.join(mw_home, "registry.xml"),
        os.path.join(mw_home, "inventory", "ContentsXML", "comps.xml"),
        os.path.join(mw_home, "oraInventory", "ContentsXML", "comps.xml"),
    ]
    for path in candidates:
        if not os.path.isfile(path):
            continue
        try:
            tree = ET.parse(path)
            root = tree.getroot()
            text = ET.tostring(root, encoding='unicode', method='xml')
            m = re.search(r"12\.2\.1\.4(?:\.0)?|12\.2\.1\.3(?:\.0)?|12\.2\.1\.2(?:\.0)?|12\.1\.3\.0(?:\.0)?|10\.3\.6\.0(?:\.0)?|14\.1\.1\.0(?:\.0)?", text)
            if m:
                return norm(m.group(0))
        except Exception:
            pass
    return None


def find_version_from_jar(mw_home):
    jar_candidates = [
        os.path.join(mw_home, "wlserver", "server", "lib", "weblogic.jar"),
        os.path.join(mw_home, "server", "lib", "weblogic.jar"),
    ]
    for jar in jar_candidates:
        if os.path.isfile(jar):
            v = parse_manifest_version(jar)
            if v:
                return v
    return None


def port_open(host, port, timeout=1.5):
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return True
    except Exception:
        return False


def classify(version, reachable):
    if version is None:
        print("UNKNOWN: could not determine WebLogic version from install tree")
        return 2

    version = norm(version)
    if any(version.startswith(p) for p in UNAFFECTED_PREFIXES):
        print(f"PATCHED: version train {version} is outside the affected range for CVE-2018-2893")
        return 0

    if version in AFFECTED:
        if reachable:
            print(f"VULNERABLE: affected base version {version} detected and listener is reachable; confirm July 2018 CPU/OPatch status immediately")
            return 1
        print(f"UNKNOWN: affected base version {version} detected, but listener was not reachable on the tested port; verify July 2018 CPU/OPatch status")
        return 2

    print(f"UNKNOWN: version {version} not confidently mapped by this checker; verify Oracle CPUJul2018 or later manually")
    return 2


def main():
    ap = argparse.ArgumentParser(description="Local helper for Oracle WebLogic CVE-2018-2893")
    ap.add_argument("--mw-home", help="Middleware home, e.g. /u01/oracle/middleware")
    ap.add_argument("--version", help="Explicit WebLogic version override, e.g. 12.2.1.3")
    ap.add_argument("--host", default="127.0.0.1", help="Host to test for listener reachability (default: 127.0.0.1)")
    ap.add_argument("--listen-port", type=int, default=7001, help="Listener port to test (default: 7001)")
    args = ap.parse_args()

    if not args.version and not args.mw_home:
        print("UNKNOWN: supply --version or --mw-home", file=sys.stderr)
        sys.exit(3)

    version = norm(args.version) if args.version else None
    if version is None and args.mw_home:
        version = find_version_from_registry(args.mw_home) or find_version_from_jar(args.mw_home)

    reachable = port_open(args.host, args.listen_port)
    rc = classify(version, reachable)
    sys.exit(rc)


if __name__ == "__main__":
    main()