erroneo.us
Search all guides⌘K

Security Digest · Apr 18, 2017 · Vulnerability · Other

Oracle WebLogic CVE-2017-3506: 2017 WLS-WSAT Bug in KEV

Unauthenticated XML command injection in WebLogic web services, fixed in the April 2017 CPU, still used by 8220 Gang miners. Find old servers.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Patched WebLogic is fine; any server still on a 2017-era release with /wls-wsat/ reachable is a cryptominer target and should be upgraded and checked for compromise.

Who must act: Anyone running Oracle WebLogic Server 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2, alone or inside another product, especially with the server's HTTP port reachable from the internet.

Who can relax: Teams on a supported WebLogic release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) with current Critical Patch Updates applied.

Affected
Oracle WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 without the April 2017 Critical Patch Update
Fixed in
April 2017 Critical Patch Update (Apr 18, 2017)
Releases covered by the October 2026 CPU: WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0
CVSS
7.4 (v3.1, NVD)
EPSS
96.0% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory every WebLogic install, including ones bundled inside other products, and record its version and applied patches.
  2. Move anything on 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2 to a supported release and apply the October 2026 Critical Patch Update.
  3. Check whether /wls-wsat/ and /_async/ paths answer from the internet, and block them at the proxy if nothing uses them.
  4. Keep WebLogic listen ports and the admin console off the public internet.
  5. On any server that was exposed while unpatched, hunt for miners and loaders before declaring it clean.

How to check if you are affected or compromised

  • Search WebLogic and proxy access logs for POST requests to /wls-wsat/CoordinatorPortType and other /wls-wsat/ or /_async/ paths from unfamiliar sources.
  • Look for PowerShell, cmd.exe, sh, curl or wget launched by the WebLogic Java process.
  • Check for the Trend Micro indicators: bin.ps1 fetched from 0xb9ac8092:443 (185.172.128.146), microsoft_office365.bat in a temp directory, bypass.ps1, and msbuild.exe talking to ports 9090-9092.
  • Watch for sustained high CPU and outbound connections to mining pools from application servers.

What happened#

Oracle fixed CVE-2017-3506 in its April 2017 Critical Patch Update. The flaw sits in the Web Services subcomponent of WebLogic Server and is exploitable over HTTP without credentials. Per CISA, a crafted HTTP request carrying a malicious XML document runs OS commands on the server. NVD scores it 7.4 because attack complexity is rated high; that has not stopped attackers.

Oracle's fix added a filter that inspects WorkContext XML before deserializing it. As Trend Micro's ZDI explains, that blocklist kept missing tags. CVE-2019-2725 and CVE-2019-2729 abused the same code through the /wls-wsat/* and /_async/* endpoints, until Oracle moved to an allowlist in 2019. The real floor is "current patches applied," not "the 2017 patch applied."

Why KEV in 2024? On May 30, 2024, Trend Micro reported that Water Sigbin, also called the 8220 Gang, was exploiting CVE-2017-3506 and CVE-2023-21839 to install a cryptocurrency miner. On Windows, the exploit pulls bin.ps1 from a hex-encoded address on port 443, writes microsoft_office365.bat to a temp folder, and loads an AES-encrypted .NET payload in memory. Linux targets get shell scripts. Trend Micro had already seen the group hit wls-wsat/CoordinatorPortType in May 2023. CISA added the CVE to KEV on June 3, 2024. The Register notes that FireEye (now Trellix) had earlier tied the bug to break-ins at Superion Click2Gov payment servers.

Who is affected#

The CVE record lists WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. None of those releases appears in Oracle's October 2026 CPU, which covers 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. A box still on a 2017-era build is therefore missing years of WebLogic fixes, not just this one. WebLogic also hides inside packaged applications, so check what yours run on.

Do you really need to act?#

If every WebLogic server is on a supported release with current CPUs, no. The risk is the forgotten server: an old Fusion Middleware stack, a vendor portal, or a test domain left reachable. Those are what the 8220 Gang scans for. A miner is noisy, but it proves someone ran code as the WebLogic user, and the same access could reach data-source passwords and keystores. Treat an exposed, unpatched server as compromised.

What to do now#

  1. Find every install and its version: java -cp $WL_HOME/server/lib/weblogic.jar weblogic.version, plus $ORACLE_HOME/OPatch/opatch lspatches for applied patches.
  2. Upgrade anything on 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2 to a supported release and apply the October 2026 CPU.
  3. Test whether the endpoint answers from outside: curl -sk -o /dev/null -w '%{http_code}\n' https://host:7001/wls-wsat/CoordinatorPortType. Block /wls-wsat/ and /_async/ at the proxy if no application needs them.
  4. Keep WebLogic listen ports and the admin console off the internet.
  5. For any server that was exposed while unpatched, rotate data-source and admin credentials after you finish hunting.

How to tell if you were hit#

Search $DOMAIN_HOME/servers/*/logs/access.log and proxy logs for POSTs to /wls-wsat/ or /_async/ paths from unfamiliar addresses. In EDR data, look for powershell.exe, cmd.exe, sh, curl or wget spawned by the WebLogic Java process. Trend Micro's indicators include bin.ps1 fetched from 0xb9ac8092:443 (185.172.128.146) and microsoft_office365.bat in a temp directory. Its 2023 report adds bypass.ps1, Winscp-setup-1867.exe, Ebvjmba.dat and an injected msbuild.exe connecting on ports 9090 to 9092. Sustained high CPU and connections to mining pools are the usual giveaway.

Timeline#

  • — Oracle's April 2017 CPU fixes CVE-2017-3506.
  • — The CVE record is published.
  • — Trend Micro's ZDI describes the follow-on bypasses and Oracle's switch to an allowlist.
  • — Trend Micro reports the 8220 Gang exploiting the bug via wls-wsat/CoordinatorPortType.
  • — Trend Micro details Water Sigbin's fileless miner campaign using CVE-2017-3506 and CVE-2023-21839.
  • — CISA adds CVE-2017-3506 to KEV; the federal deadline is June 24, 2024.
  • — Oracle's latest CPU, the current patch floor for supported WebLogic releases.

Vulnerability records

  • CVE-2017-3506 · KEV 2024-06-03 · Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Oracle — Critical Patch Update Advisory, April 2017 oracle.com
  2. Oracle — Critical Patch Update Advisory, October 2026 oracle.com
  3. CVE record — CVE-2017-3506 cve.org
  4. NVD — CVE-2017-3506 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2017-3506 cisa.gov
  6. Trend Micro — Decoding Water Sigbin's Latest Obfuscation Tricks trendmicro.com
  7. Trend Micro — 8220 Gang Evolves With New Strategies trendmicro.com
  8. Trend Micro ZDI — Using whitelisting to remediate an RCE vulnerability (CVE-2019-2729) in Oracle WebLogic trendmicro.com

Coverage and analysis

  1. The Register — 7-year-old Oracle WebLogic bug under active exploitation theregister.com