tenable:157127 · Oracle WebLogic Server (Jan 2022 CPU)

01 · The Real Story

Another Oracle CPU drop, another batch of WebLogic deserialization and path-traversal bugs that ransomware crews already know how to weaponize

The January 2022 Oracle Critical Patch Update bundles roughly two dozen WebLogic fixes against versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The headline issues are CVE-2022-21306 (T3/IIOP core deserialization, unauthenticated, network-reachable, CVSSv3 9.8), CVE-2022-21371 (Web Container local file inclusion / path traversal, now CISA KEV-listed with a Feb 13 2025 due date), and CVE-2022-21292 in the Samples component. The Tenable plugin also chains in the tail end of the Log4Shell family — *CVE-2021-44832* and *CVE-2021-4104* — both of which WebLogic ships with.

Tenable rates the bundle HIGH (CVSSv3 7.5) because that's the score of the *least-bad* covered CVE. That undersells reality. The actual ceiling here is the T3 deserialization RCE plus a KEV-listed file-read primitive on a product whose attack surface has been continuously exploited (CVE-2017-10271, CVE-2019-2725, CVE-2020-14882, CVE-2020-2883, CVE-2023-21839) by every commodity botnet and ransomware affiliate for the last eight years. Vendor severity is understated — this is a CRITICAL on any WebLogic host carrying production workloads.

"KEV-listed WebLogic bug on a server class that has been mass-exploited every year since 2017 — patch now, not next quarter."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Discover exposed WebLogic admin/T3 ports

Attacker fingerprints WebLogic via the default console paths (/console/login/LoginForm.jsp, /em) on 7001/7002 or scans for raw T3 banners. Mass scanners (zgrab2, nuclei templates weblogic-detect.yaml) and Shodan facets product:"Oracle WebLogic" make this trivial. Internet-exposed WebLogic still sits in the tens of thousands of hosts per Shodan.

Conditions required:

Network reachability to HTTP/HTTPS or T3/T3s port
Default service banner not stripped

Where this breaks in practice:

Mature shops front WebLogic with a WAF / reverse proxy that hides /console
T3 is rarely exposed to the internet on hardened deployments

Detection/coverage: Nessus 157127, Qualys QID 87425, nuclei weblogic-detect, shodan product:weblogic all flag it

STEP 02

Trigger CVE-2022-21306 T3/IIOP deserialization

Attacker sends a crafted T3 or IIOP packet carrying a gadget chain (typically a variant of the CommonsCollections or JdbcRowSetImpl chain) that WebLogic's broken blacklist still resolves. Public PoCs exist as weblogic_exploit scripts and Metasploit modules derived from earlier CVE-2020-2883 work. Result: unauthenticated RCE as the WebLogic process user.

Conditions required:

T3 or IIOP reachable from attacker position
Patch not applied — install at <Jan 2022 CPU baseline

Where this breaks in practice:

T3 filter rules (weblogic.security.net.ConnectionFilterImpl) when correctly configured drop external T3
Network segmentation that limits T3 to backend tier

Detection/coverage: Snort/Suricata rules for T3 deserialization chains; EDR catches child-process spawns from java.exe/startWebLogic.sh

STEP 03

OR — abuse CVE-2022-21371 web-container path traversal

If T3 is filtered, the attacker pivots to the KEV-listed CVE-2022-21371 LFI in the Web Container over plain HTTP(S). This reads arbitrary files — SerializedSystemIni.dat, config.xml, boot.properties — yielding the AES key and the encrypted WebLogic admin password. Decryption with WebLogicPasswordDecryptor returns cleartext admin creds.

Conditions required:

HTTP/HTTPS reachable
Unpatched WebLogic

Where this breaks in practice:

WAF rules covering generic LFI patterns may catch the specific path
Read-only domain layout limits what files are reachable

Detection/coverage: WAF alerts on ../ and %2e%2e sequences against WebLogic URIs; file-integrity monitoring on the WL domain dir

STEP 04

Authenticate to admin console and deploy malicious WAR

With recovered admin credentials from step 3 the attacker logs into /console, deploys a JSP webshell WAR (cmd.war, behinder.war, godzilla.war), and gets command execution as the WebLogic user. This is the same playbook used by DarkIRC, Kinsing, TeamTNT, and 8220 Gang cryptominers.

Conditions required:

Admin console reachable
Deploy permission for the recovered account

Where this breaks in practice:

Console restricted by network ACL to admin VLAN only
Read-only admin accounts

Detection/coverage: EDR on JSP write to deployment dir; Splunk for new app deployments in AdminServer.log

STEP 05

Privilege escalation and lateral movement

WebLogic typically runs as oracle on Linux or a domain service account on Windows. Attacker steals datasource credentials from config.xml to reach back-end Oracle DBs, dumps Kerberos tickets via Rubeus on Windows, or stages ransomware (LockBit, BlackBasta affiliates have used WebLogic as initial access). Blast radius reaches the data tier and adjacent middleware in one hop.

Conditions required:

Code execution from step 2 or 4
Lateral reachability to DB / AD

Where this breaks in practice:

Service account with no domain rights
Database firewalling that limits SQL surface

Detection/coverage: EDR on credential dumping; DB audit on unusual login times/sources from WL host

03 · Compensating Control

Block T3/T3s and IIOP at the perimeter and between trust zones — Configure weblogic.security.net.ConnectionFilterImpl to deny T3/T3s/IIOP from anything but the admin VLAN. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.

Restrict /console and /em to a jump-host VLAN — Front WebLogic with an reverse proxy or NGFW rule that exposes only the application contexts and blocks /console, /em, /wls-wsat, /_async/. Same 3-day window.

Deploy WAF signatures for known WebLogic exploit URIs — Block ..%2f, double-encoded traversal, and known T3 magic bytes. F5, Akamai, AWS WAF, and ModSecurity all ship rule packs for WebLogic CVE classes.

Rotate WebLogic admin passwords and datasource credentials — If you suspect exposure window, assume SerializedSystemIni.dat was read and admin creds leaked. Rotate before patching to invalidate any previously stolen secrets.

Hunt for webshells and miner persistence — Search WebLogic deployment dirs for unexpected WAR/JSP files; review AdminServer.log for app deployment events from off-hours; check cron and systemd for Kinsing-class persistence.

What doesn't work

Disabling the Samples component alone — CVE-2022-21306 and CVE-2022-21371 are in Core and Web Container, not Samples.
Java version updates — these are application-layer bugs in WebLogic's own code; bumping JDK does nothing.
Network segmentation alone — the LFI variant is HTTP, not T3, so blocking T3 doesn't cover the KEV-listed CVE.
Relying on TLS — TLS only encrypts; the gadget payload is valid traffic to WebLogic.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	CVE-2022-21371 added to CISA KEV (due date 2025-02-13). WebLogic family has continuous exploitation by Kinsing, 8220 Gang, TeamTNT, and ransomware affiliates.
Public PoC availability	PoCs on GitHub for CVE-2022-21306 (`Y4er/CVE-2022-21306`, `BabyTeam1024/CVE-2022-21306`) and CVE-2022-21371 (`hktalent` repos). Metasploit modules adapted from CVE-2020-2883 chain.
EPSS	CVE-2022-21306 ≈ 0.92 (97th percentile); CVE-2022-21371 ≈ 0.78 (95th percentile)
KEV status	CVE-2022-21371 listed; deadline already past for federal agencies
CVSS vector (worst CVE in bundle)	CVE-2022-21306: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` (9.8 Critical) — unauth network RCE
Affected versions	WebLogic 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 prior to January 2022 CPU
Fixed by	Apply January 2022 CPU patches per Oracle advisory; subsequent CPUs (Apr/Jul/Oct 2022, 2023, 2024, 2025) supersede
Exposure data	Shodan `product:"Oracle WebLogic"` consistently returns 20k–40k internet-exposed instances; Censys shows similar; T3 exposure smaller but non-zero
Disclosure date	2022-01-18 (Oracle CPU)
Reporters	Multiple — Oracle credits researchers including Yongtao Wang, @testanull, and others in the CPU acknowledgements

Sources.

05 · The Call

Final Verdict

↑ UPGRADED to CRITICAL (9.1/10)

Why this verdict

KEV-listed: CVE-2022-21371 is on CISA's Known Exploited Vulnerabilities catalog — federal due date already lapsed, meaning real campaigns observed in the wild.
Unauth network RCE in same bundle: CVE-2022-21306 is a T3/IIOP deserialization RCE with CVSS 9.8 and public PoCs; Tenable's HIGH rating reflects the weakest CVE, not the worst.
Role multiplier: WebLogic is the canonical Java EE app server for Oracle EBS, PeopleSoft, and bespoke enterprise apps — the chain ends in datasource credential theft and DB compromise, not a single-host pop. Floor is CRITICAL.
Friction is moderate, not high: T3 is often filtered externally but rarely between internal tiers; the LFI alternative works over plain HTTP and bypasses T3 hardening entirely.
Continuous exploitation history: WebLogic has been the persistent favorite of Kinsing, 8220 Gang, TeamTNT and LockBit affiliates — patch lag here gets you owned.

Why not higher?

There is no higher bucket than CRITICAL. The reassessed numeric score is held at 9.1 rather than 9.8 because the worst single CVE (T3 deserialization) often requires internal positioning when T3 is properly filtered at the edge.

Why not lower?

Downgrading to HIGH would ignore the KEV listing and the unauth RCE in the same bundle. Any WebLogic instance carrying production data is a high-value-role host by definition, so the deployment-role floor is CRITICAL regardless of network friction.

06 · Verification

Crowdsourced verification payload.

Run on each WebLogic middle-tier host as the oracle (or whichever) WebLogic owner. Invoke as ./check_wls_jan2022_cpu.sh /u01/app/oracle/middleware. Requires read access to the WL home and registry.xml.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# noisgate verifier: Oracle WebLogic Server Jan 2022 CPU (Tenable 157127)
# Usage: ./check_wls_jan2022_cpu.sh <WL_HOME>
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
WL_HOME="${1:-/u01/app/oracle/middleware}"
REG="$WL_HOME/inventory/registry.xml"

if [[ ! -f "$REG" ]]; then
  echo "UNKNOWN: registry.xml not found at $REG"
  exit 2
fi

# Extract WL base version
VER=$(grep -oE 'name="WebLogic Server"[^>]*version="[0-9.]+"' "$REG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
echo "WebLogic version: ${VER:-unknown}"

case "$VER" in
  12.1.3.0.0|12.2.1.3.0|12.2.1.4.0|14.1.1.0.0) ;;
  "") echo "UNKNOWN: cannot parse version"; exit 2 ;;
  *) echo "PATCHED: version $VER not in affected list"; exit 0 ;;
esac

# Look for Jan 2022 CPU patch IDs in OPatch inventory
if command -v "$WL_HOME/OPatch/opatch" >/dev/null 2>&1; then
  PATCHES=$("$WL_HOME/OPatch/opatch" lsinventory 2>/dev/null | grep -E '33727616|33591019|33727640|33697227' )
  if [[ -n "$PATCHES" ]]; then
    echo "PATCHED: Jan 2022 CPU patch detected"
    echo "$PATCHES"
    exit 0
  fi
fi

echo "VULNERABLE: WebLogic $VER without Jan 2022 (or later) CPU patch applied"
exit 1