| name | exploit-weblogic |
| description | Oracle WebLogic T3/IIOP deserialization RCE exploit (CVE-2023-21839, CVE-2020-14882). Targets Oracle WebLogic Server admin consoles and T3 listener ports. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}} |
exploit-weblogic
Exploits Oracle WebLogic Server deserialization vulnerabilities via the T3 and IIOP protocols for unauthenticated remote code execution.
Target Framework
Oracle WebLogic Server 10.x, 12.x, 14.x — CVE-2023-21839 (IIOP/T3 JNDI injection) and CVE-2020-14882 (admin console auth bypass + RCE).
Usage
Provide target (WebLogic base URL or T3 endpoint, e.g. t3://host:7001). The skill fingerprints the version and selects the appropriate exploit chain automatically.
Parameters
| Param | Type | Required | Description |
|---|
| target | string | yes | WebLogic URL or T3 endpoint |
| cve | string | no | Force a specific CVE (e.g. CVE-2023-21839) |
| cmd | string | no | OS command to execute (default: id) |
| timeout | int | no | Timeout in seconds (default: 60) |
Notes
T3 port is typically 7001 or 7002. Admin console is on port 7001 HTTP/HTTPS. Use nmap to confirm open WebLogic ports before exploitation.
