CVE-2024-21182 CrowdStrike LogScale · LogScale

Detect Oracle WebLogic Server CVE-2024-21182 Exploitation Attempt in CrowdStrike LogScale

Detects exploitation attempts targeting CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Oracle WebLogic Server is a high-value target for threat actors due to its prevalence in enterprise Java EE environments. Exploitation may enable remote code execution, unauthorized data access, or server compromise.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "HttpRequest")
| $RemotePort IN (7001, 7002, 4848, 9002)
  OR $TargetURL IN ["*wls-wsat*", "*_async*", "*uddiexplorer*", "*bea_wls_internal*"]
| eval SuspiciousPath = case(
    $TargetURL = "*wls-wsat*", "Deserialization - WSAT",
    $TargetURL = "*_async*", "Deserialization - Async",
    $TargetURL = "*uddiexplorer*", "SSRF - UDDI",
    $TargetURL = "*bea_wls_internal*", "Internal Endpoint",
    "WebLogic Port Access"
  )
| groupBy([RemoteAddressIP4, LocalAddressIP4, RemotePort, SuspiciousPath, TargetURL, HttpMethod], function=[count(aid, as=RequestCount), min(timestamp, as=FirstSeen), max(timestamp, as=LastSeen)])
| sort RequestCount desc
| $RequestCount > 0
critical severity medium confidence

CrowdStrike Falcon LogScale (CQL) detection for CVE-2024-21182 Oracle WebLogic exploitation. Monitors endpoint network telemetry for connections to WebLogic ports and URL patterns associated with known exploit vectors.

Data Sources

CrowdStrike Falcon endpoint telemetryCrowdStrike network detectionFalcon HTTP inspection

Required Tables

falcon:events

False Positives & Tuning

  • WebLogic server-to-server communication on standard ports within application clusters
  • Authorized penetration testing activity against WebLogic systems
  • Application deployment tools connecting to WebLogic admin ports
  • Load balancer health check probes targeting WebLogic listener ports

Other platforms for CVE-2024-21182

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1WebLogic WSAT Endpoint Probe

    Expected signal: HTTP GET request logged in WebLogic access.log to /wls-wsat/CoordinatorPortType from attacker IP on port 7001. Network flow data showing connection to WebLogic port.

  2. Test 2WebLogic Async Servlet POST Probe

    Expected signal: HTTP POST to /_async/AsyncResponseService visible in WebLogic access logs and network proxy logs. Process audit logs may show WebLogic JVM processing the request.

  3. Test 3WebLogic UDDI Explorer SSRF Probe

    Expected signal: HTTP GET request to /uddiexplorer/ path logged in WebLogic access log. If SSRF is active, outbound connection attempt from WebLogic server to 127.0.0.1:22 visible in network monitoring.

  4. Test 4WebLogic Admin Console Access Attempt

    Expected signal: HTTP GET to /console/login/LoginForm.jsp in WebLogic access logs. Windows Security event logs may show network logon attempts if authentication is attempted. Network flow logs capture the connection.

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the WebLogic server version and patch level. Compare against Oracle CPU July 2024 advisory to determine if the system is in the affected version range for CVE-2024-21182.
  2. Review WebLogic server access logs (server.log, access.log) for the specific endpoint paths flagged: /wls-wsat/, /_async/, /uddiexplorer/, /bea_wls_internal/. Note source IPs, timestamps, HTTP methods, and response codes.
  3. Check whether the source IP is known/authorized: cross-reference with asset inventory, authorized admin ranges, and threat intelligence feeds. Determine if the IP appears in any known malicious actor databases.
  4. Inspect WebLogic stdout/stderr logs for Java exceptions, ClassCastException, or deserialization errors that may indicate an attempted or successful exploit execution.
  5. Verify whether any new processes were spawned by the WebLogic JVM process around the time of the suspicious requests (look for cmd.exe, /bin/bash, curl, wget as child processes).

Containment

  1. If active exploitation is confirmed, immediately isolate the affected WebLogic server from network access. Place the host in a quarantine VLAN or apply host-based firewall rules blocking inbound connections on ports 7001, 7002, and 4848.
  2. Block the source IP(s) at the perimeter firewall and WAF. If the source appears to be a cloud egress IP or Tor exit node, apply a broader block on the identified CIDR range and notify the SOC.
  3. Disable or restrict access to vulnerable WebLogic endpoints at the load balancer/reverse proxy layer: block /wls-wsat/, /_async/, /uddiexplorer/ URLs until patching is confirmed. This reduces attack surface without full service outage.

Evidence Collection

  1. Capture a full memory dump of the affected WebLogic JVM process using tools like jmap or OS-level memory acquisition (winpmem/avml on Linux). This preserves in-memory artifacts of any deserialized payload or injected code.
  2. Collect and preserve WebLogic server logs, access logs, and domain configuration files. Archive them to a secured evidence location with hash verification. Include: /domain/servers/*/logs/, /domain/servers/*/data/, and any modified .xml configuration files.
  3. Extract network packet captures (PCAP) from the time window of the alert, focusing on traffic to/from the WebLogic server on ports 7001/7002. Look for T3/IIOP protocol traffic containing serialized Java object payloads.

Escalation Criteria

  • !Escalate immediately to IR team if any of the following are observed: new child processes spawned by WebLogic (especially shells or system utilities), outbound connections from WebLogic to external IPs, new files written to the WebLogic domain directory or OS temp paths, or evidence of credential harvesting from the server.
  • !Escalate if the affected WebLogic server has access to sensitive databases, internal APIs, or is part of a multi-tier application handling PII, financial data, or authentication services — the blast radius of a successful exploit extends to all connected systems.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >WebLogic server.log and access.log entries showing POST/GET requests to /wls-wsat/, /_async/, or /uddiexplorer/ endpoints
  • >Java heap dump artifacts containing deserialized payload classes or injected ClassLoader instances
  • >File system changes in WebLogic domain directories: new .class files, modified config.xml, unexpected .war or .jar deployments
  • >OS-level process artifacts: child processes spawned by WebLogic JVM, suspicious scheduled tasks/cron entries created after exploit time
  • >Network artifacts: outbound connections from WebLogic host to attacker C2 infrastructure, unusual DNS queries from the server

Tuning Guidance

Baseline normal WebLogic traffic patterns before deploying this detection in production. If WebLogic is used for SOAP/WS-AT integrations, the /wls-wsat/ path may generate legitimate traffic — add known internal service IPs to an exclusion list. For environments where WebLogic console access is managed through a jump server or bastion, whitelist that bastion IP for /console/ path requests. Tune the confidence threshold based on whether the WebLogic server is internet-facing (raise severity) or internal-only (lower confidence). Consider correlating with authentication events: failed WebLogic admin logins preceding suspicious endpoint access strongly increases confidence of an attack in progress.

Hunting Queries

Hunt for child processes spawned by Java/WebLogic JVM processes, which may indicate successful code execution following CVE-2024-21182 exploitation. Focuses on common post-exploitation shells and download utilities.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID in (4688, 4689)
| where ParentProcessName has_any ("java", "javaw", "weblogic")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "bash", "sh", "curl", "wget", "certutil")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, SubjectUserName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows OR index=linux sourcetype IN ("WinEventLog:Security", "linux_secure")
(EventCode=4688 OR action="execve")
(parent_process_name IN ("java", "javaw", "java.exe") AND process_name IN ("cmd.exe", "powershell.exe", "/bin/bash", "/bin/sh", "curl", "wget"))
| table _time, host, parent_process_name, process_name, process_id, cmdline, user
| sort - _time

Hunt for sustained POST request campaigns targeting WebLogic exploit endpoints over the past week. Repeated POST requests to these paths are a strong indicator of automated exploit tooling or persistent attacker activity.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceProduct has "WebLogic" or DestinationPort in (7001, 7002, 4848)
| where RequestURL has_any ("/wls-wsat/", "/_async/", "/uddiexplorer/")
| where RequestMethod == "POST"
| summarize RequestCount=count(), UniqueIPs=dcount(SourceIP), Paths=make_set(RequestURL) by bin(TimeGenerated, 1h)
| where RequestCount > 5
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* (sourcetype=oracle:weblogic OR sourcetype=access_combined)
http_method=POST
(uri_path="/wls-wsat/*" OR uri_path="/_async/*" OR uri_path="/uddiexplorer/*")
earliest=-7d
| timechart span=1h count AS post_requests dc(src_ip) AS unique_src_ips
| where post_requests > 5

Atomic Red Team Tests

Test 1 WebLogic WSAT Endpoint Probe
linux

Simulates reconnaissance of the CVE-2024-21182 attack surface by probing WebLogic's WSAT endpoint. This is a read-only probe that tests endpoint availability without triggering actual deserialization.

Command

bash 
curl -sk -X GET http://TARGET_WEBLOGIC_HOST:7001/wls-wsat/CoordinatorPortType -H 'Content-Type: text/xml' --max-time 10 -o /tmp/wsat_probe_response.txt && echo 'Probe complete. Check /tmp/wsat_probe_response.txt'

Cleanup

bash 
rm -f /tmp/wsat_probe_response.txt

Expected Telemetry

HTTP GET request logged in WebLogic access.log to /wls-wsat/CoordinatorPortType from attacker IP on port 7001. Network flow data showing connection to WebLogic port.

Expected Detection

Alert on HTTP GET to /wls-wsat/ path from non-whitelisted source IP. Detection rule matches on suspicious_path = 'T3/IIOP deserialization path'.

Test 2 WebLogic Async Servlet POST Probe
linux

Simulates the initial HTTP POST request to WebLogic's async servlet endpoint, which is a common initial step in deserialization exploit chains. Uses a benign XML body to test detection without executing payloads.

Command

bash 
curl -sk -X POST http://TARGET_WEBLOGIC_HOST:7001/_async/AsyncResponseService -H 'Content-Type: text/xml;charset=UTF-8' -H 'SOAPAction: ""' -d '<?xml version="1.0" encoding="utf-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Body><tns:probe xmlns:tns="http://test">detection_test</tns:probe></soapenv:Body></soapenv:Envelope>' --max-time 10

Cleanup

bash 
No cleanup required — no files created on target

Expected Telemetry

HTTP POST to /_async/AsyncResponseService visible in WebLogic access logs and network proxy logs. Process audit logs may show WebLogic JVM processing the request.

Expected Detection

Alert triggered on POST request to /_async/ path. High severity due to POST method to known deserialization endpoint. Detection should fire within 60 seconds of the request.

Test 3 WebLogic UDDI Explorer SSRF Probe
linux

Simulates probing of the WebLogic UDDI Explorer endpoint, which has historically been vulnerable to SSRF attacks and is associated with reconnaissance in WebLogic exploit chains.

Command

bash 
curl -sk 'http://TARGET_WEBLOGIC_HOST:7001/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=test&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:22' --max-time 10 -o /tmp/uddi_probe.txt; cat /tmp/uddi_probe.txt | grep -i 'error\|connection\|refused\|timeout' | head -5

Cleanup

bash 
rm -f /tmp/uddi_probe.txt

Expected Telemetry

HTTP GET request to /uddiexplorer/ path logged in WebLogic access log. If SSRF is active, outbound connection attempt from WebLogic server to 127.0.0.1:22 visible in network monitoring.

Expected Detection

Alert on access to /uddiexplorer/ endpoint. SSRF indicators should additionally trigger network anomaly detection if WebLogic makes unexpected loopback connections.

Test 4 WebLogic Admin Console Access Attempt
windows

Simulates unauthorized access attempt to the WebLogic administration console, which may precede credential brute-forcing or exploitation of admin console vulnerabilities.

Command

powershell 
Invoke-WebRequest -Uri 'http://TARGET_WEBLOGIC_HOST:7001/console/login/LoginForm.jsp' -Method GET -UseBasicParsing -TimeoutSec 10 | Select-Object -ExpandProperty StatusCode

Cleanup

powershell 
No cleanup required

Expected Telemetry

HTTP GET to /console/login/LoginForm.jsp in WebLogic access logs. Windows Security event logs may show network logon attempts if authentication is attempted. Network flow logs capture the connection.

Expected Detection

Alert on console path access from non-admin IP ranges. Combined with prior detections on /wls-wsat/ or /_async/ access, should escalate confidence to high for active exploitation campaign.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesT1027Obfuscated Files or Information

Same Tactic: Initial Access

Popular Detections