Weblogic Deserialization Vulnerability Testing and Resolution

Through this vulnerability, you can write files to the server without logging in and only need to specify the IP and port number.

An exception may occur: Unsupported major.minor version 51.0
JDK compilation environment is inconsistent, solution: upgrade JDK

1. Test
java -jar Test.jar weblogic 192.168.0.11 7001 F:/a.txt
Note: The txt file is directly generated in the specified IP computer , you need to download a test JAR package After

performing this operation, if the computer on the IP generates a.txt file, it proves that the vulnerability exists (this command is operated under windows, and the file path is modified under linux, which has not been tested yet).

2. Solution

Find
..\weblogic\Middleware\modules\com.bea.core.apache.commons.collections_3.2.0.jar to

download the latest official collections.jar, replace the original jar package, and restart the application service