SRC-2019-0014 : Oracle Application Testing Suite UploadServlet External Entity Injection Information Disclosure Vulnerability

Vulnerability Details:

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Oracle Application Testing Suite. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UploadServlet servlet. Due to the improper restriction of XML External Entity (XXE) reference, a specially crafted multipart request causes the XML parser to access the contents of an attacker controlled URI and embed these contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose sensitive information under the context of the SYSTEM.

Affected Vendors:

Oracle

Affected Products:

Application Testing Suite

Vendor Response:

Oracle has issued an update to correct this vulnerability. More details can be found at: <https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html&gt;