Oracle WebLogic Server

The January 2023 Oracle CPU rolls up multiple WebLogic flaws — but the headline is CVE-2023-21839, an unauthenticated JNDI injection over T3/IIOP that yields remote code execution on the WebLogic JVM. Adjacent bugs (CVE-2023-21838/21841/21842, plus dependency CVEs in jackson-databind CVE-2022-40150 and Xstream CVE-2018-7489) round out the bundle. Affected supported versions are 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 — and in practice, every unsupported 10g/12.1.x install in your environment is also vulnerable and won't get a fix.

Oracle scored CVE-2023-21839 as 7.5 and the plugin lands at HIGH. Reality is harsher. Within weeks of disclosure a working PoC dropped on GitHub (ASkyeye/CVE-2023-21839, ~400 stars), and on May 1, 2023 CISA added it to KEV based on active in-the-wild exploitation. WebLogic boxes are crown-jewel application tier — they hold DB credentials, datasource keys, and SSO secrets. Vendor HIGH is undercalled; this is CRITICAL in any environment where T3 is reachable from anywhere an attacker can put a packet.

Why this verdict

• KEV-listed (2023-05-01) with confirmed exploitation — the noisgate rule mandates immediate action regardless of vendor score
• Unauthenticated RCE via T3/IIOP — no credentials, no user interaction, no chain dependency; a single packet flow is enough
• Public weaponized PoC within ~6 weeks of CPU release; ASkyeye/CVE-2023-21839 is copy-paste exploitation
• EPSS ≥0.9 / 99th percentile — exploit probability is essentially saturated
• Role multiplier: WebLogic is canonically a Tier-1 application server hosting prod workloads, DB credentials in boot.properties, and federated SSO connectors — RCE here is a direct pivot to the data tier and identity plane. ≥10% of installs occupy this high-value role by definition → CRITICAL floor
• Friction is real but does not break the floor: T3 should not be internet-facing, yet Shodan still indexes thousands of exposed listeners and internal-network exposure is universal — requires internal network would only justify dropping to HIGH on an asset class that isn't already KEV-confirmed exploited

Why not higher?

There is no higher bucket than CRITICAL in the noisgate schema. The reassessed score of 9.8 (not 10.0) reflects that exploitation requires the WebLogic JVM to reach an attacker-controlled LDAP/HTTP endpoint, which egress filtering can disrupt in mature environments.

Why not lower?

Downgrading to HIGH would require either (a) no active exploitation evidence or (b) a credential or user-interaction prerequisite. Neither is present: KEV-listed, unauthenticated, network-reachable, with PoCs in wide circulation. Vendor's HIGH/7.5 only scored confidentiality impact and ignored that the bug ends in code execution.

1. Block T3/T3s and IIOP at the perimeter immediately — Configure WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3s/IIOP from anything outside the cluster subnet. This neutralizes CVE-2023-21839's transport. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Egress-block WebLogic hosts from initiating outbound LDAP/LDAPS/HTTP to non-allowlisted destinations — The JNDI lookup must fetch the malicious reference from the attacker. Default-deny egress at the host firewall or NGFW kills step 3. Pair with NetFlow alerts on any new outbound LDAP from app-tier subnets. Deploy within 3 days.
3. Front WebLogic with a reverse proxy / WAF that only proxies HTTP(S) application paths — Apache/Nginx/F5 in front of WebLogic, terminating only the application URI prefix, prevents direct T3 framing reaching the listener. Verify the proxy does not pass Upgrade or non-HTTP framing. Within 3 days.
4. Inventory legacy unsupported WebLogic (10.3.6, 12.1.x) — These will not receive a patch and are equally or more vulnerable. Identify, isolate, and schedule decommissioning within the 90-day noisgate CRITICAL remediation window.

Run on each WebLogic host as the oracle user (or whoever owns $MW_HOME). Invoke as ./check_weblogic_jan2023.sh /u01/app/oracle/middleware where the argument is the Middleware Home. Read-only; no privileges beyond filesystem access to the install.

#!/usr/bin/env bash
# noisgate verifier — Oracle WebLogic Jan 2023 CPU (CVE-2023-21839 et al.)
# Usage: ./check_weblogic_jan2023.sh <MW_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
MW_HOME="${1:-}"
if [[ -z "$MW_HOME" || ! -d "$MW_HOME" ]]; then
  echo "UNKNOWN: pass a valid Middleware Home as arg 1"; exit 2
fi

OPATCH="$MW_HOME/OPatch/opatch"
if [[ ! -x "$OPATCH" ]]; then
  echo "UNKNOWN: OPatch not found at $OPATCH"; exit 2
fi

# Jan 2023 CPU patch IDs per Oracle Doc 2917213.2
# 12.2.1.3.0 -> 34908279 ; 12.2.1.4.0 -> 34907994 ; 14.1.1.0.0 -> 34907991
JAN2023_PATCHES=(34908279 34907994 34907991)

INSTALLED=$("$OPATCH" lsinventory 2>/dev/null) || {
  echo "UNKNOWN: opatch lsinventory failed"; exit 2
}

VER=$(echo "$INSTALLED" | awk -F: '/Oracle WebLogic Server/ {print $2; exit}' | tr -d ' ')
echo "Detected WebLogic: ${VER:-unknown}"

for p in "${JAN2023_PATCHES[@]}"; do
  if echo "$INSTALLED" | grep -qw "$p"; then
    echo "PATCHED: Jan 2023 CPU patch $p present"
    exit 0
  fi
done

# Also accept any later quarterly CPU that supersedes Jan 2023
LATER=$(echo "$INSTALLED" | grep -Eo 'Patch  [0-9]+' | awk '{print $2}')
for p in $LATER; do
  if [[ "$p" -gt 35000000 ]]; then
    echo "PATCHED: a post-Jan-2023 CPU ($p) is installed"
    exit 0
  fi
done

echo "VULNERABLE: no Jan 2023 (or later) CPU patch detected for $VER"
exit 1

Sources

1. Tenable plugin 170165
2. Oracle Critical Patch Update Advisory — January 2023
3. NVD — CVE-2023-21839
4. CISA KEV add (2023-05-01)
5. FortiGuard Threat Signal — CVE-2023-21839 added to KEV
6. SecurityWeek — CISA warns of attacks exploiting WebLogic CVE-2023-21839
7. Rapid7 vuln DB — CVE-2023-21838
8. FIRST EPSS