Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-35587 | Unauthenticated RCE in Oracle Access Manager (OpenSSO Agent) CVE-2021-35587 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the OpenSSO Agent component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access can send crafted HTTP requests to the affected component and, because the endpoint requires no authentication, achieve takeover of Oracle Access Manager — effectively pre-authentication remote code execution with high impact on confidentiality, integrity, and availability. Organizations running Oracle Access Manager 11.1.2.3.0, 12.2.1.3.0, or 12.2.1.4.0 are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-11-28, and security press reported more than 150 internet-exposed Oracle Access Management systems. EPSS assigns a 96.3% probability of exploitation within 30 days, although no public proof-of-concept code is known. Do: Apply Oracle's update for CVE-2021-35587 per vendor instructions (delivered via the Oracle Critical Patch Update covering this flaw) to bring Access Manager 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 to a fixed release; this is the required action in CISA's KEV entry. Until patched, restrict HTTP access to OpenSSO Agent/Access Manager endpoints at the perimeter and review access logs for signs of unauthenticated exploitation. | 9.8 | 96% | KEV |
| niche≈150+ internet-exposed Oracle Access Manager systems identified by public scans |
Full article300 words · extracted from helpnetsecurity.com · click to collapse
A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
About CVE-2021-35587
CVE-2021-35587 was discovered by security researchers “Jang” (Nguyen Jang) and “Peterjson” in late 2021 by accident, while “building PoC for another mega-0day.”
The vulnerability is in the OpenSSO Agent component of the Oracle Access Manager product, which is widely used by corporations for single sign-on (SSO) as part of the Oracle Fusion Middleware suite.
It may allow an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager and use it to create users with any privileges or to execute arbitrary code on the victim’s server, Jang explained earlier this year.
The vulnerability affected v11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0 of Oracle Access Manager and has been patched in those supported versions, but according to Jang, it also affects Oracle Weblogic Server 11g (10.3.6.0) and OAM 11g (11.1.2.0.0), which stopped being supported on January 1, 2022, and therefore don’t have a patch available for this RCE.
Active exploitation
Several proof-of-concept exploits for CVE-2021-35587 have been published on GitHub after Jang and Peterjson released part of theirs in March 2022, but according to CISA, successful exploitation attempts have now been detected. Unfortunately, the agency has not provided any insight into these attack(s).
The fact that this vulnerability has made it into the KEV catalog means that US Federal Civilian Executive Branch agencies are required to implement the patches by December 19, 2022, but CISA “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/11/29/cve-2021-35587-exploited/