No‑Credentials RCE: One POST request grants root on Pakistan’s largest bank

Event Overview

Habib Bank Limited (HBL), Pakistan’s largest bank with over $30 billion in assets, exposes two internet‑facing web‑banking nodes (ibank.hbl.com and www.ibank.hbl.com) behind an Imperva WAF. The WAF fails to block requests to the /wls-wsat/CoordinatorPortType endpoint.

Technical Analysis

Vulnerability Principle

WebLogic’s WS‑AT service accepts a SOAP envelope whose <work:WorkContext> element is handed directly to java.beans.XMLDecoder. XMLDecoder deserializes XML into live Java objects, including constructor calls and method execution, effectively allowing arbitrary code execution on the server.

Example payload that spawns a shell:

new ProcessBuilder("/bin/sh", "-c", "<attacker command>").start()

The process runs under the WebLogic service account, and because WS‑AT is an old machine‑to‑machine transaction coordinator, it lacks any authentication step.

Attack Path

Internet attacker
    │
    ▼
[1] Unauthenticated POST → /wls-wsat/CoordinatorPortType
    │           │
    ▼           ▼
  HTTP 500   ROOT SHELL (blind execution, no output)
  (always returns 500)
    │
    ▼
[2] Read config.xml → obtain all JDBC datasource definitions (host, port, service name, encrypted passwords)
    │
    ▼
[3] Steal SerializedSystemIni.dat → decrypt boot.properties to reveal admin console credentials
    │   (admin username/password become visible in clear text)
    ▼
[4] Read active user Session Token from memory → session hijack (bypasses OTP/MFA)
    ▼
[5] Hook into login flow → capture RSA‑encrypted passwords at decryption time (future user credentials in clear)
    ▼
[6] Persist via setDomainEnv.sh startup script → control survives reboot
    ▼
[7] Use JDBC datasource and Node Manager credentials → lateral movement to core banking systems

Compound Vulnerabilities Amplifying Risk

_async RCE – another unauthenticated deserialization entry (CVE‑2019‑2725); fixing one does not close the other.

UDDI Explorer SSRF – CVE‑2014‑4210 enables internal network topology discovery.

Internal IP leak – exposure of 10.200.75.9:4443 provides direct internal address.

263 leaked credentials – found in public telemetry data, offering another entry point.

The Imperva WAF’s path‑normalisation can be bypassed using known semicolon‑path tricks, so relying on the WAF alone is insufficient.

Threat Landscape

Actors Targeting This Vulnerability

Ransomware groups / Initial Access Brokers – continuously scan for exposed WebLogic deserialization endpoints, then use compromised hosts for lateral movement, mass encryption, and double‑ransom scenarios (e.g., Qilin listed HBL as a target in Nov 2025).

APT groups – prefer stealthy, long‑term persistence, leveraging credential harvesting and session hijacking for espionage and sanction‑evasion financing.

Economically motivated cybercrime gangs – exploit session hijack and payment tampering for quick monetisation, favouring short‑lived, low‑visibility exploits.

Opportunistic botnets – add newly discovered endpoints to mining, DDoS, or resale inventories within days.

Why Detection Is Difficult

Blind execution : regardless of payload success, the server always returns HTTP 500, so WAFs and logs see only “blocked request”.

Encrypted traffic : all communication passes through HTTPS + Imperva, leaving IDS sensors with only ciphertext.

Post‑compromise masquerade : activities such as reading config files, running Java commands, or invoking management APIs appear as normal WebLogic behaviour.

Stealthy persistence : scripts like setDomainEnv.sh are legitimate maintenance files, rarely monitored for changes.

Defensive Recommendations

Immediate remediation : disable or delete the /wls-wsat/ and /_async/ endpoints; apply Oracle Critical Patch Updates that include fixes for CVE‑2017‑10271 and CVE‑2019‑2725.

Access control : never expose the WebLogic admin console to the public internet; enforce strict firewall rules, VPN, or internal‑only access; block IIOP/T3 and WLS‑WSAT protocol traffic from untrusted subnets.

Monitoring enhancements :

Generate alerts for any request to /wls-wsat/ or /_async/, even if the response is 500.

Implement integrity monitoring for configuration files (config.xml, boot.properties, SerializedSystemIni.dat) and startup scripts (setDomainEnv.sh).

Deploy Runtime Application Self‑Protection (RASP) to detect deserialization attacks.

Penetration testing : regularly scan internet‑facing application layers for legacy WebLogic ports; include these endpoints in red‑team reconnaissance.

Conclusion

The Oracle WebLogic deserialization flaw patched in 2017 remains exploitable in 2026, allowing an unauthenticated POST request to obtain root on Pakistan’s largest bank’s online banking system. The issue is not isolated; it co‑exists with additional vulnerabilities—dual unauthenticated RCE, SSRF discovery, credential leaks, and WAF bypass—forming a full‑blown attack chain that effectively provides attackers with a complete playbook.

Defenders must treat “behind the WAF” as a false sense of security and continuously validate that legacy endpoints are removed, patches are applied, and monitoring is capable of spotting blind‑execution patterns.