CVE-2022-21371

What it actually does

This is an unauthenticated, network-reachable path traversal vulnerability in the Oracle WebLogic Server Web Container component. A remote attacker can send specially crafted HTTP requests that cause the server to resolve file paths outside the intended web-accessible directory, allowing unauthorized read access to sensitive files or application resources accessible to the WebLogic process. The CVSS vector indicates high confidentiality impact with no required privileges, no user interaction, low attack complexity, and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose application configuration, secrets, credentials, source artifacts, session-related data, or other sensitive files readable by the WebLogic service account. Even though the scored impact is primarily data exposure, leaked credentials or configuration can enable follow-on compromise of applications, databases, identity systems, or cloud resources. The very high EPSS score and weaponized exploit maturity mean internet-facing or broadly reachable instances should be treated as high-priority remediation targets, despite the CVE not currently being listed in CISA KEV. The supplied affected-product metadata references minio/minio, which conflicts with the Oracle WebLogic description, so asset owners should verify product applicability before closing remediation based on package inventory alone.

How an attack unfolds

An attacker first identifies an HTTP or HTTPS endpoint running a vulnerable WebLogic Server version. They then send crafted HTTP requests containing directory traversal patterns or encoded traversal sequences intended to escape the intended web context and reach files elsewhere on the server. If vulnerable, the Web Container improperly resolves the requested path and returns file contents that should not be externally accessible. The attacker typically starts with low-noise probes for known WebLogic resources, then attempts to retrieve configuration files, deployment descriptors, application artifacts, logs, credential stores, or other sensitive local files readable by the WebLogic process. Information obtained through this vulnerability may be used for reconnaissance, credential theft, lateral movement, or chaining with other WebLogic or application-layer vulnerabilities.

How to fix it

Apply the relevant Oracle Critical Patch Update for affected Oracle WebLogic Server versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. Prioritize internet-facing WebLogic servers and any systems reachable from untrusted networks. If immediate patching is not possible, restrict HTTP/S access to trusted networks, place WebLogic behind a properly configured reverse proxy or WAF, block traversal patterns and double-encoded traversal attempts, disable or remove unnecessary deployed applications and default resources, and ensure the WebLogic process account has least-privilege filesystem access. Because the provided fixed-version list references minio/minio commit 61a7434379164c0a2150db8047343e9ec769ae91 rather than Oracle WebLogic, validate the affected product source of truth before using that commit as evidence of remediation.

How to confirm the fix worked

Confirm the installed Oracle WebLogic version and Oracle CPU patch level on every affected host, and verify that the applicable Oracle security patch has been applied. Re-scan externally and internally exposed WebLogic endpoints to ensure vulnerable versions are no longer present. Review reverse proxy, WAF, load balancer, and application server access logs for traversal probes before and after remediation. Where safe and authorized, perform a non-destructive validation request for traversal handling and confirm the server returns a denial, normalization failure, 400-series response, or generic error rather than file contents. Also validate that filesystem permissions prevent the WebLogic service account from reading unnecessary secrets, backups, application archives, or administrative files.

Typical attack path

1. Scan for externally reachable Oracle WebLogic HTTP or HTTPS services.
2. Fingerprint WebLogic version, exposed applications, console paths, or default WebLogic resources.
3. Send crafted HTTP GET requests containing path traversal sequences such as ../ or encoded equivalents.
4. Observe whether the server returns files or resources outside the intended web application directory.
5. Attempt to retrieve sensitive configuration, deployment, application, or log files readable by the WebLogic process.
6. Use disclosed data, secrets, or environment details to support additional compromise, credential abuse, or lateral movement.

How to detect it

Investigate HTTP access logs from WebLogic, reverse proxies, load balancers, CDN/WAF platforms, and network security sensors for requests containing traversal sequences, encoded traversal payloads, attempts to access WebLogic configuration files, or unusual requests for files that are not normal web resources. Pay particular attention to successful 200 responses, unusually large response sizes, repeated 400/403/404 probing followed by 200 responses, and requests to administrative or internal paths from unfamiliar external IP addresses. Review WebLogic server logs for file-not-found errors, invalid URI normalization errors, servlet mapping anomalies, and stack traces involving path canonicalization or static resource handling. If exploitation is suspected, preserve web logs, WAF logs, JVM/application logs, filesystem timestamps, and any evidence of downloaded configuration or deployment artifacts. Follow-on activity may include authentication attempts using exposed credentials, access from the same source IPs to administrative consoles, database login attempts, or requests to additional internal services discovered from leaked configuration.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %2e%2e%5c
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• %c0%ae%c0%ae%c0%af
• /WEB-INF/web.xml
• /WEB-INF/weblogic.xml
• /META-INF/MANIFEST.MF
• config.xml
• boot.properties
• SerializedSystemIni.dat
• jdbc.xml
• weblogic.xml
• setDomainEnv.sh
• setDomainEnv.cmd
• servers/AdminServer/logs
• servers/AdminServer/security/boot.properties

What your security team should do

• Prioritize patching or isolating all internet-facing Oracle WebLogic Server instances because exploit maturity is weaponized and EPSS is very high.
• Resolve the product metadata mismatch between the Oracle WebLogic CVE description and the supplied minio/minio affected-package data before marking assets remediated.
• Search historical HTTP access logs, reverse proxy logs, WAF events, and WebLogic logs for path traversal attempts and suspicious file retrieval activity.
• Implement temporary WAF or reverse-proxy rules to block raw, encoded, and double-encoded traversal sequences while patching is underway.
• Inventory WebLogic versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 across production, staging, disaster recovery, and appliance-like deployments.
• Review exposed configuration files, credential stores, deployment descriptors, and logs for potential secret exposure if exploitation is suspected.
• Rotate credentials and secrets that may have been readable by the WebLogic process on any server with evidence of exploitation.
• Reduce WebLogic service account filesystem permissions and remove unnecessary files from web-accessible or application-readable paths.