Oracle E-Business Suite RCE (CVE-2025-61882)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266696);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/13");

  script_cve_id("CVE-2025-61882");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/10/27");

  script_name(english:"Oracle E-Business Suite RCE (CVE-2025-61882)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a remote code execution vulnerability");
  script_set_attribute(attribute:"description", value:
"The versions of Oracle E-Business Suite installed on the remote host are affected a remote code execution
vulnerability as referenced in the CVE-2025-61882 Security Alert Advisory.

  - Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). 
    Supported versions that are affected are 12.1.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker 
    with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result 
    in takeover of Oracle Concurrent Processing. (CVE-2025-61882)

Oracle notes that the October 2023 Critical Patch Update is a prerequisite for application of the updates
provided in the CVE-2025-61882 Security Alert Advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.oracle.com/security-alerts/alert-cve-2025-61882.html#AppendixEBS
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bed07e3a");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the October CVE-2025-61882 advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-61882");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:e-business_suite");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_e-business_query_patch_info.nbin");
  script_require_keys("Oracle/E-Business/Version", "Oracle/E-Business/patches/installed");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_ebusiness::get_app_info();

var new_patches_12_1 = '38501376, 38501349, 38501757';
var new_patches_12_2 = '38501230, 38501349, 38501757';

var constraints = [
  # 12.1 - just the new CVE-2025-61882 patches
  { 'min_version' : '12.1.3', 'max_version' : '12.1.3.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.4', 'max_version' : '12.1.4.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.5', 'max_version' : '12.1.5.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.6', 'max_version' : '12.1.6.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.7', 'max_version' : '12.1.7.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.8', 'max_version' : '12.1.8.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.9', 'max_version' : '12.1.9.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.10', 'max_version' : '12.1.10.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.11', 'max_version' : '12.1.11.99999999', 'fix_patches' : new_patches_12_1 },
  { 'min_version' : '12.1.12', 'max_version' : '12.1.12.99999999', 'fix_patches' : new_patches_12_1 },
  
  # 12.2 patches - new CVE-2025-61882 patches added on top of Oct 2023 CPU patches, which are a prerequisite according to Oracle
  { 'min_version' : '12.2.3', 'max_version' : '12.2.3.99999999', 'fix_patches' : '35642926, ' + new_patches_12_2 },
  { 'min_version' : '12.2.4', 'max_version' : '12.2.4.99999999', 'fix_patches' : '35642926, 35634961, ' + new_patches_12_2 },
  { 'min_version' : '12.2.5', 'max_version' : '12.2.5.99999999', 'fix_patches' : '35642926, 35634910, ' + new_patches_12_2 },
  { 'min_version' : '12.2.6', 'max_version' : '12.2.6.99999999', 'fix_patches' : '35642926, 35736181, ' + new_patches_12_2 },
  { 'min_version' : '12.2.7', 'max_version' : '12.2.7.99999999', 'fix_patches' : '35642926, 35736182, ' + new_patches_12_2 },
  { 'min_version' : '12.2.8', 'max_version' : '12.2.8.99999999', 'fix_patches' : '35642926, 35812748, ' + new_patches_12_2 },
  { 'min_version' : '12.2.9', 'max_version' : '12.2.9.99999999', 'fix_patches' : '35642926, 35736189, ' + new_patches_12_2 },
  { 'min_version' : '12.2.10', 'max_version' : '12.2.10.99999999', 'fix_patches' : '35642926, 35736226, ' + new_patches_12_2 },
  { 'min_version' : '12.2.11', 'max_version' : '12.2.11.99999999', 'fix_patches' : '35642926, 35736229, ' + new_patches_12_2 },
  { 'min_version' : '12.2.12', 'max_version' : '12.2.12.99999999', 'fix_patches' : '35642926, ' + new_patches_12_2 }
];

vcf::oracle_ebusiness::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  fix_date:'20251006'
);