Oracle WebLogic Server T3/IIOP Protocol Information Disclosure Vulnerability Advisory (CVE-2024-21182)

1. Apply Official Security Patches

Apply the latest security patches provided in the Oracle July 2024 Critical Patch Update (CPU).

2. Temporary Mitigation (Restrict T3 and IIOP Protocols)

If patching cannot be performed immediately, restrict network access to T3 and IIOP protocols.

A. Configure Connection Filters for T3/T3S

Use WebLogic's Connection Filter to restrict T3 access to trusted IP addresses only.

• Path: Domain -> Security -> Filter
• Connection Filter Class: weblogic.security.net.ConnectionFilterImpl
• Filter Rule Example (Allow trusted subnet, deny others):

127.0.0.1 * * allow
192.168.1.0/24 * * allow
* * * deny

B. Disable IIOP Protocol

If the IIOP protocol is not required in your environment, disable it entirely.

• Path: Environment -> Servers -> [Server Name] -> Protocols -> IIOP
• Action: Uncheck Enable IIOP and restart the server.

CVE-2024-21182 is a high-severity information disclosure vulnerability in the Core component of Oracle WebLogic Server. It allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the server without requiring any user interaction.

The root cause lies in improper input validation within the handling of T3/IIOP serialized traffic. An attacker can send crafted protocol requests to bypass access controls, resulting in unauthorized access to sensitive system data. This vulnerability has a CVSS 3.1 Base Score of 7.5, specifically impacting data confidentiality. Due to its active exploitation in the wild, it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, making immediate remediation critical.