Exploitation attempts for Oracle E-Business Suite flaw observed after PoC release
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-21587 | Unauthenticated Arbitrary File Upload in Oracle E-Business Suite Oracle E-Business Suite versions 12.2.3 through 12.2.11 contain a critical, unauthenticated arbitrary file upload flaw (CWE-306, missing authentication) in the Upload component of the Web Applications Desktop Integrator. Because exploitation requires no credentials and no user interaction, any attacker with HTTP network access to the affected component can trigger the flaw remotely and achieve takeover of Oracle Web Applications Desktop Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Organizations running any affected E-Business Suite 12.2 release are exposed, particularly where EBS interfaces are reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-02-02 with known ransomware use, EPSS assigns a 98.3% probability of exploitation within 30 days, and exploitation attempts were observed after a public proof-of-concept was released. Do: Apply the Oracle Critical Patch Update that addresses CVE-2022-21587 (October 2022 CPU or later) on all E-Business Suite 12.2.3-12.2.11 systems, per CISA's required action. Until patched, restrict internet access to EBS, especially the Web Applications Desktop Integrator upload endpoints, and review logs and uploaded-file locations for signs of exploitation. Prioritize remediation given confirmed active exploitation and ransomware use. | 9.8 | 98% | KEV ransomware PoC |
| largetens of thousands of E-Business Suite deployments worldwide, with thousands of internet-exposed instances (estimate) |
Full article306 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 03, 2023
Threat actors started exploiting a critical Oracle E-Business Suite flaw, tracked as CVE-2022-21587, shortly after a PoC was published.
Shadowserver researchers warn that threat actors have started attempting to exploit critical Oracle E-Business Suite flaw (CVE-2022-21587) shortly after a PoC was published.
— Shadowserver (@Shadowserver) January 25, 2023Since Jan 21st we are seeing exploitation attempts in our honeypot sensors for Oracle E-Business Suite CVE-2022-21587 (CVSS 9.8 RCE) shortly after a PoC was published. Advisory & patch was issued by Oracle in Oct 2022: https://t.co/QRDKaHEREU
NVD entry: https://t.co/wdbGuX5rTj
The E-Business Suite is a set of enterprise applications that allows organizations automate processes such as supply chain management (SCM), enterprise resource planning (ERP), and customer relationship management (CRM).
The vulnerability resides in the Web Applications Desktop Integrator of Oracle’s enterprise product and was addressed in October 2022.
An unauthenticated attacker can easily exploit the flaw via HTTP to take over Oracle Web Applications Desktop Integrator installs. The issue impacts versions 12.2.3-12.2.11.
“Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator.” reads the advisory.
Shadowserver reported to have observed first exploitation attempts on January 21, only five days after the cybersecurity firm Viettel Cyber Security released a PoC exploit code for this issue.
The researchers recommend to install the patch from Oracle to address the issue, however, if they cannot do it, that can use the firewall to block requests sent to the following URLs:
- /OA_HTML/BneUploaderService
- /OA_HTML/BneViewerXMLService
- /OA_HTML/BneDownloadService
- /OA_HTML/BneOfflineLOVService
US CISA added the CVE-2022-21587 flaw to its Known Exploited Vulnerabilities (KEV) catalog ordering federal agencies to fix it by February 23, 2023.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2022-21587)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/141782/hacking/oracle-e-business-suite-flaw-poc.html