Oracle Integration Gateway File Upload Vulnerability

1. ADVISORY INFORMATION
Title:  File Upload in Integration Gateway (PSIGW)
Advisory ID: [ERPSCAN-17-039]
Advisory URL: https://erpscan.com/advisories/erpscan-17-039-file-upload-integration-gateway-psigw-peoplesoft/
Risk: High
Date published: 18.07.2017
Vendor contacted: Oracle

2. VULNERABILITY INFORMATION
Class: File Upload
Impact: Remote command execution on the server
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2017-10061

CVSS Information
CVSS Base Score v3: 8.3 / 10
CVSS Base Vector:

AV: Attack Vector (Related exploit range) Network (N)
AC: Attack Complexity (Required attack complexity) Low (L)
PR: Privileges Required (Level of privileges needed to exploit) None (N)
UI: User Interaction (Required user participation) None (N)
S: Scope (Change in scope due to impact caused to components beyond
the vulnerable component) Changed (C)
C: Impact to Confidentiality Low (L)
I: Impact to Integrity Low (L)
A: Impact to Availability Low (L)

3. VULNERABILITY DESCRIPTION

An attacker can upload arbitrary text files on Oracle PeopleSoft HCM
9.2 system, which can be leveraged to get remote command execution on
the server (for example, attackers can write their own public RSA key
in ~/.ssh/authorized_keys file and get valid SSH session)

4. VULNERABLE PACKAGES

Oracle PeopleSoft HCM 9.2

5. SOLUTIONS AND WORKAROUNDS

Check upload content (add xml validation) before overwriting
device_map.xml file in
com.peoplesoft.pt.integrationgateway.service.Device_ID handler

6. AUTHOR
Roman Shalymov

#  0day.today [2018-03-20]  #