CVE-2013-3763
published 2013-07-17CVE-2013-3763: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect…
PriorityP351medium5.5CVSS 2.0
AVNACLAuSCPIPAN
EXPLOIT
EPSS
59.84%
99.0th percentile
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | fusion_middleware | — | — |
| oracle | fusion_middleware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target the controlSoapBinding web service endpoint at /ws/control on port 7770 for POST requests with SOAPAction header set to empty string ("") ↗
- →Look for SOAP requests invoking the createDataStore method with command injection patterns (ampersand-delimited OS commands) in the datastore name or files parameters ↗
- →Detect HTTP 500 responses from Oracle Endeca Server containing 'Error creating data files at' or 'Data files don't exist' as indicators of successful exploitation attempt ↗
- →Monitor for PowerShell execution spawned from Oracle Endeca Server process on Windows, as the exploit delivers payload via cmd_psh_payload (PowerShell) ↗
- →Check for versionResponse in SOAP replies to Oracle Endeca Server to identify reconnaissance probing for version 7.4.0 prior to exploitation ↗
- ·The command injection vulnerability only exists in Oracle Endeca Server 7.4.0 branch; the createDataStore method is not present in 7.5.5.1 and later branches ↗
- ·The injection is Windows-specific; non-Windows deployments of Oracle Endeca Server 7.4.0 are not affected by this particular exploit vector ↗
- ·PowerShell-based payload delivery is constrained by the Windows 2008 Command Prompt maximum length of 8191 characters; payloads exceeding 8000 characters will fail ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wm53-2q9h-xhmq: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7
ghsa_unreviewed·2022-05-17·CVSS 5.5
CVE-2013-3763 [MEDIUM] GHSA-wm53-2q9h-xhmq: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764.
GHSA
GHSA-3p5h-w9pp-xh48: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7
ghsa_unreviewed·2022-05-17·CVSS 5.5
CVE-2013-3764 [MEDIUM] GHSA-3p5h-w9pp-xh48: Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3763.
No detection rules found.
Exploit-DB
Oracle Endeca Server - Remote Command Execution (Metasploit)
exploitdb·2013-08-26
CVE-2013-3763 Oracle Endeca Server - Remote Command Execution (Metasploit)
Oracle Endeca Server - Remote Command Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Oracle Endeca Server Remote Command Execution',
'Description' => %q{
This module exploits a command injection vulnerability on the Oracle Endeca
Server 7.4.0. The vulnerability exists on the createDataStore method from the
controlSoapBinding web service. The vulnerable method only exists on the 7.4.0
branch and isn't available on the 7.5.5.1 branch. On the other hand, the injection
has been found to be Windows specific. This module has been tested succe
Metasploit
Oracle Endeca Server Remote Command Execution
metasploit
Oracle Endeca Server Remote Command Execution
Oracle Endeca Server Remote Command Execution
This module exploits a command injection vulnerability on the Oracle Endeca Server 7.4.0. The vulnerability exists on the createDataStore method from the controlSoapBinding web service. The vulnerable method only exists on the 7.4.0 branch and isn't available on the 7.5.5.1 branch. In addition, the injection has been found to be Windows specific. This module has been tested successfully on Endeca Server 7.4.0.787 over Windows 2008 R2 (64 bits).
No writeups or analysis indexed.
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlhttp://www.securitytracker.com/id/1028801http://www.zerodayinitiative.com/advisories/ZDI-13-190/http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlhttp://www.securitytracker.com/id/1028801http://www.zerodayinitiative.com/advisories/ZDI-13-190/
2013-07-17
Published