CVE-2024-21182: Oracle WebLogic Server Active Exploitation — Detection and Remediation

---
title: WebLogic Server Spawning Shell
id: 85b2b4a1-9c4d-4f3b-8a2e-1c5d6f7e8a9b
status: experimental
description: Detects WebLogic (Java) process spawning a shell or command interpreter, a common behavior post-exploitation for RCE vulnerabilities.
references:
 - https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2024/06/01
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\java.exe'
   ParentCommandLine|contains: 'weblogic'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
falsepositives:
 - Legitimate administrative debugging (rare)
level: high
---
title: Linux WebLogic Spawning Shell
id: 9c3d5e2a-0f1b-4a5c-9d6e-1f2a3b4c5d6e
status: experimental
description: Detects WebLogic on Linux spawning a shell process.
references:
 - https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2024/06/01
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith: '/java'
   ParentCommandLine|contains: 'weblogic'
   Image|endswith:
     - '/bin/sh'
     - '/bin/bash'
     - '/bin/zsh'
falsepositives:
 - Legitimate administrative debugging
level: high


**KQL (Microsoft Sentinel)**

// Hunt for WebLogic process spawning suspicious child processes
DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessFileName == "java"
| where InitiatingProcessCommandLine contains "weblogic"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "zsh")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for Java processes (WebLogic) spawning shells
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid IN (
    SELECT Ppid
    FROM pslist()
    WHERE Name =~ "sh" OR Name =~ "bash" OR Name =~ "cmd.exe" OR Name =~ "powershell.exe"
)
AND Name =~ "java"
AND CommandLine =~ "weblogic"


**Remediation Script (Bash)**

#!/bin/bash
# WebLogic CVE-2024-21182 Check and Harden Script
# Note: Always verify specific patch requirements in the Oracle advisory.

echo "Checking for WebLogic processes..."
WLS_PID=$(ps -ef | grep "[w]eblogic.Server" | awk '{print $2}')

if [ -z "$WLS_PID" ]; then
    echo "No running WebLogic Server instances found."
    exit 0
else
    echo "Found WebLogic Server running with PID: $WLS_PID"
fi

# Attempt to find WebLogic Home from environment or process
WLS_HOME=$(readlink -f /proc/$WLS_PID/cwd | sed 's\/user_projects\/.*$//')

if [ -d "$WLS_HOME" ]; then
    echo "Detected WebLogic Home: $WLS_HOME"
    # Check version in registry.xml or config.xml (simplified check)
    echo "--------------------------------------------------"
    echo "Action Required:"
    echo "1. Verify your version against the Oracle Advisory for CVE-2024-21182."
    echo "2. Download and apply the latest Critical Patch Update (CPU) from Oracle."
    echo "3. If patching is not immediately possible, restrict T3/IIOP access via firewall."
    echo "--------------------------------------------------"
else
    echo "Could not automatically determine WebLogic Home directory."
fi

# Network Hardening Check (Firewall)
echo "Checking for T3/IIOP exposure (Default ports 7001, 7002)..."
if netstat -tuln | grep -E ':7001|:7002' | grep LISTEN > /dev/null; then
    echo "WARNING: WebLogic is listening on default ports. Ensure T3/IIOP channels are disabled or restricted to trusted subnets."
else
    echo "WebLogic does not appear to be listening on default ports (or is not running as root)."
fi