CVE-2020-2551

What is Oracle WebLogic Server?

Oracle WebLogic Server is a Java EE application server widely deployed to run enterprise business applications, frequently as the backend for Oracle's own ERP and middleware products as well as custom enterprise Java applications. WebLogic has a long history as an attractive attack target: its default configuration exposes several powerful, high-privilege protocols (T3, IIOP) that were designed for trusted internal cluster communication but are frequently reachable from untrusted networks in real deployments.

Overview

CVE-2020-2551 is an unauthenticated remote code execution vulnerability in WebLogic Server's Core Components, reachable via the IIOP (Internet Inter-ORB Protocol) — a CORBA-based protocol WebLogic uses for object communication, alongside the more commonly discussed T3 protocol. Oracle shipped the fix in its January 2020 Critical Patch Update without extensive public technical detail, but as with prior WebLogic CVEs, researchers reverse-engineered a working exploit from the patch diff within days, and cryptomining campaigns began targeting internet-exposed WebLogic servers shortly after (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical).

Technical Details

WebLogic's IIOP and T3 protocols allow serialized Java objects to be exchanged between trusted cluster nodes; when reachable by an untrusted client, an attacker can submit crafted serialized objects that exploit deserialization gadget chains present in WebLogic's classpath, achieving remote code execution without authentication. This vulnerability class — unauthenticated RCE via WebLogic's internal RPC protocols — recurred across multiple CVE cycles through 2019–2020, with each new CVE typically representing either a new gadget chain or a new bypass of Oracle's prior blocklist-style mitigations for the previous bug.

Discovery

Patched as part of Oracle's routine quarterly Critical Patch Update process; Oracle does not typically credit external researchers by name in its CPU release notes for WebLogic Core Component fixes.

Exploitation Context

Public proof-of-concept exploit code and active scanning followed within days of the January 2020 CPU release, consistent with WebLogic's established pattern where any new T3/IIOP-reachable RCE is weaponized almost immediately given the large population of internet-exposed WebLogic instances and cryptomining botnets already primed to scan for them.

Remediation

1. Apply Oracle's January 2020 Critical Patch Update (or any later CPU that supersedes it) immediately.
2. Block T3 and IIOP protocol access from untrusted networks at the firewall level — these protocols should only be reachable from trusted WebLogic cluster peers, never from the general internet or untrusted internal segments.
3. Disable the IIOP protocol entirely if your WebLogic deployment doesn't use CORBA-based integrations, reducing attack surface regardless of patch status.
4. Check for unauthorized processes or cryptomining activity on any WebLogic server that has had T3/IIOP reachable from the internet, given this vulnerability class's established history of opportunistic cryptomining exploitation.