WebLogic的4月安全公告

参考：

• https://www.oracle.com/security-alerts/cpuapr2020.html

CVE-2020-2915

Oracle Coherence存在MVEL表达式注入漏洞，受此漏洞影响的版本包括3.7.1.0、12.1.3.0.0、12.2.1.3.0和12.2.1.4.0。未经身份验证的攻击者可通过精心构造的T3请求来利用此漏洞，成功利用此漏洞的攻击者可接管Oracle Coherence。

通过T3协议触发：
涉及组件：
Caching, CacheStore, Invocation

参考：

• https://docs.oracle.com/en/middleware/fusion-middleware/coherence/12.2.1.4/develop-remote-clients/performing-grid-operations-rest.html#GUID-B7985230-DA8F-497B-959A-F64E4ADD0F72
• https://docs.oracle.com/en/middleware/fusion-middleware/coherence/12.2.1.4/java-reference/com/tangosol/coherence/rest/util/extractor/MvelExtractor.html

调用栈：

exec:347, Runtime (java.lang)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:498, Method (java.lang.reflect)
getValue:48, MethodAccessor (com.tangosol.coherence.mvel2.optimizers.impl.refl.nodes)
getValue:45, MethodAccessor (com.tangosol.coherence.mvel2.optimizers.impl.refl.nodes)
getValue:31, StaticReferenceAccessor (com.tangosol.coherence.mvel2.optimizers.impl.refl.nodes)
getValue:66, DynamicGetAccessor (com.tangosol.coherence.mvel2.optimizers.dynamic)
getReducedValueAccelerated:98, ASTNode (com.tangosol.coherence.mvel2.ast)
execute:85, MVELRuntime (com.tangosol.coherence.mvel2)
getValue:128, CompiledExpression (com.tangosol.coherence.mvel2.compiler)
executeExpression:1039, MVEL (com.tangosol.coherence.mvel2)
extract:86, MvelExtractor (com.tangosol.coherence.rest.util.extractor)
toString:580, LimitFilter (com.tangosol.util.filter)
readObject:86, BadAttributeValueExpException (javax.management)
...

CVE-2020-2546

参考：
https://github.com/hktalent/CVE_2020_2546