Oracle WebLogic exploitation attempts via crafted console URL parameters (CVE-2020-14882)

Detects WebLogic console exploitation attempts by matching encoded traversal patterns in HTTP URI query strings.

FreeUnreviewedSigmahighv1

oracle-weblogic-exploitation-attempts-via-crafted-console-url-parameters-cve-202-85d466b0

title: Oracle WebLogic exploitation attempts via crafted console URL parameters (CVE-2020-14882)
id: 4ef93ecf-6ed5-480d-b18a-866f36f64367
status: test
description: This rule flags WebLogic server requests containing specific encoded path traversal patterns in the URI query, consistent with attempted exploitation attempts against the application console. Attackers may use these crafted parameters to access or manipulate internal resources through traversal-like behavior. It relies on webserver telemetry that captures the HTTP URI query string so the encoded substrings can be matched.
references:
  - https://isc.sans.edu/diary/26734
  - https://twitter.com/jas502n/status/1321416053050667009?s=20
  - https://twitter.com/sudo_sudoka/status/1323951871078223874
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-14882/web_cve_2020_14882_weblogic_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-11-02
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2020-14882
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - /console/images/%252E%252E%252Fconsole.portal
      - /console/css/%2e
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 85d466b0-d74c-4514-84d3-2bdd3327588b
    type: derived

What it detects

This rule flags WebLogic server requests containing specific encoded path traversal patterns in the URI query, consistent with attempted exploitation attempts against the application console. Attackers may use these crafted parameters to access or manipulate internal resources through traversal-like behavior. It relies on webserver telemetry that captures the HTTP URI query string so the encoded substrings can be matched.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.