CVE-2017-3506

影响范围

• Oracle WebLogic Server 10.3.6.0
• Oracle WebLogic Server 12.1.3.0
• Oracle WebLogic Server 12.2.1.0
• Oracle WebLogic Server 12.2.1.1
• Oracle WebLogic Server 12.2.1.2

漏洞原理

使用 XMLDecoder 解析 SOAP 请求内容时，对请求中 <object> 标签标识的 Java 对象进行 了反序列化。

调用栈：

readObject:250, XMLDecoder (java.beans)
readUTF:111, WorkContextXmlInputAdapter (weblogic.wsee.workarea)
readEntry:92, WorkContextEntryImpl (weblogic.workarea.spi)
receiveRequest:179, WorkContextLocalMap (weblogic.workarea)
receiveRequest:163, WorkContextMapImpl (weblogic.workarea)
receive:71, WorkContextServerTube (weblogic.wsee.jaxws.workcontext)
readHeaderOld:107, WorkContextTube (weblogic.wsee.jaxws.workcontext)
processRequest:43, WorkContextServerTube (weblogic.wsee.jaxws.workcontext)
...

补丁，添加 WorkContextXmlInputAdapter#validate 方法，禁用 <object> 标签：

private void validate(InputStream is) {
      WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();
      try {
         SAXParser parser = factory.newSAXParser();
         parser.parse(is, new DefaultHandler() {
            public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
               if(qName.equalsIgnoreCase("object")) {
                  throw new IllegalStateException("Invalid context type: object");
               }
            }
         });
      } catch (ParserConfigurationException var5) {
         throw new IllegalStateException("Parser Exception", var5);
      } catch (SAXException var6) {
         throw new IllegalStateException("Parser Exception", var6);
      } catch (IOException var7) {
         throw new IllegalStateException("Parser Exception", var7);
      }
   }

CVE-2017-10271 使用 <void> 代替 <object> 绕过过滤。