Listen to this Post
How the mentioned CVE works
This vulnerability resides within the BI Publisher Integration component of Oracle Concurrent Processing. The flaw allows an unauthenticated attacker to send a specially crafted HTTP request to the vulnerable system. Due to insufficient validation of user-supplied input, this request can trigger the deserialization of malicious data. By leveraging a deserialization gadget chain, the attacker can execute arbitrary code on the underlying server. This process bypasses authentication entirely, requiring only network access. Successful exploitation grants the attacker complete control over the Oracle Concurrent Processing service, leading to a full compromise of the system’s confidentiality, integrity, and availability.
DailyCVE Form:
Platform: Oracle E-Business Suite
Version: 12.2.3-12.2.14
Vulnerability: Remote Code Execution
Severity: Critical
date: October 2022
Prediction: Expected Patch July 2022
What Undercode Say:
curl -X POST http://target:port/OA_HTML/BPIntegrated.jsp -H "Content-Type: application/xml" --data-binary @payload.xml
// Gadget chain leveraging internal classes
public class ExploitObject implements Serializable {
private Object readResolve() {
// Code execution logic
Runtime.getRuntime().exec("calc.exe");
return this;
}
}
How Exploit:
1. Craft malicious serialized object.
2. Send object via HTTP POST.
3. Trigger deserialization on server.
4. Execute arbitrary system commands.
Protection from this CVE
1. Apply Oracle Critical Patch Update.
2. Restrict network access.
3. Use firewall rules.
Impact:
1. Complete system compromise.
2. Unauthenticated access.
3. Data breach.
4. Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
