CVE-2013-1559
published 2013-04-17CVE-2013-1559: Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to…
PriorityP339medium4CVSS 2.0
AVNACLAuSCNINAP
EXPLOIT
EPSS
58.82%
99.0th percentile
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect ActiveX instantiation of CheckOutAndOpenControl (CheckOutAndOpen.dll) in a browser context, particularly calls to the openWebdav() method with an HTTP/UNC URI argument ending in .hta ↗
- →Alert on mshta.exe being spawned as a child of a browser process (e.g. iexplore.exe) with a remote HTTP URL argument ending in .hta — this is the direct execution path triggered by the vulnerable ActiveX control ↗
- →Monitor for HTTP responses with Content-Type: application/hta served to Internet Explorer clients, especially when the request originates from a CheckOutAndOpen ActiveX openWebdav() call ↗
- →Detect wscript.exe executing a randomly-named .vbs file from %TEMP%, followed immediately by execution of a randomly-named .exe from %TEMP% — this is the HTA payload delivery chain used by the exploit ↗
- →The exploit only targets Internet Explorer; requests from non-MSIE user-agents are rejected. Network detection should focus on MSIE user-agent strings fetching .hta resources from attacker-controlled servers. ↗
- →The Metasploit module uses 'migrate -f -k' as InitialAutoRunScript post-exploitation; detect meterpreter process migration activity following mshta.exe execution as a post-compromise indicator ↗
- ·The exploit targets only Oracle WebCenter Content 11.1.1.6.0 with the CheckOutAndOpenControl ActiveX installed; version 10.1.3.5.1 is also listed as affected per the advisory but was not confirmed in exploit testing ↗
- ·SMB-based URI delivery is theoretically possible but requires the WebClient service, which is only enabled by default on Windows XP SP3; the HTA/HTTP delivery path is preferred and more broadly applicable ↗
- ·The exploit is Internet Explorer-only; other browsers will receive a 404 response and the attack will not proceed ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle WebCenter Content - 'CheckOutAndOpen.dll' ActiveX Remote Code Execution (Metasploit)
exploitdb·2013-06-05
CVE-2013-1559 Oracle WebCenter Content - 'CheckOutAndOpen.dll' ActiveX Remote Code Execution (Metasploit)
Oracle WebCenter Content - 'CheckOutAndOpen.dll' ActiveX Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution",
'Description' => %q{
This modules exploits a vulnerability found in the Oracle WebCenter Content
CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav(), where
user controlled input is used to call ShellExecuteExW(). This module abuses the
control to execute an arbitrary HTA from a remote location. This module
Metasploit
Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
metasploit
Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
This module exploits a vulnerability found in the Oracle WebCenter Content CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav(), where user controlled input is used to call ShellExecuteExW(). This module abuses the control to execute an arbitrary HTA from a remote location. This module has been tested successfully with the CheckOutAndOpenControl ActiveX installed with Oracle WebCenter Content 11.1.1.6.0.
No writeups or analysis indexed.
2013-04-17
Published