CVE-2017-10366
published 2017-10-19CVE-2017-10366: Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that…
PriorityP276critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
43.49%
98.6th percentile
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
rO0ABXVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cH////d1cQB+AAB////3dXEAfgAAf///93VxAH4AAH////d1cQB+AAB////3dXEAfgAAf///93VxAH4AAH////d1cQB+AAB////3
- →Detect unauthenticated HTTP POST requests to the /monitor/<SITE_NAME> path; this endpoint should not accept POST bodies from unauthenticated external clients. ↗
- →Java deserialization payloads begin with the magic bytes 'rO0AB' (base64 of 0xACED0005); detect HTTP POST bodies starting with these bytes to the /monitor path. ↗
- →Monitor for OutOfMemoryError in PeopleSoft logs as an indicator of a DoS deserialization attack: 'Exception in thread "Thread-2" java.lang.OutOfMemoryError: Java heap space' ↗
- →Probe/fingerprint detection: a valid site name returns the string 'Ping successful. Site %SITE_NAME% is valid.' — monitor for automated enumeration of site names via this response. ↗
- →Detect DNS lookups to attacker-controlled domains (e.g., *.jexboss.info) originating from PeopleSoft application servers, which indicate successful URLDNS gadget chain execution. ↗
- →Detect use of ysoserial tool on the network or host: process execution of 'ysoserial-0.0.6-SNAPSHOT-all.jar' with the URLDNS gadget chain argument. ↗
- ·The vulnerable endpoint path includes a site name component (%SITE_NAME%) that varies per deployment; attackers may brute-force or discover it via information disclosure before exploiting. Detection rules must account for wildcard matching on /monitor/<any_site_name>. ↗
- ·Blocking /monitor at the perimeter is the recommended mitigation; updating gadget libraries (e.g., commonsCollections) alone is insufficient as new gadget chains are regularly discovered. ↗
- ·The vulnerability is exploitable without authentication; no session cookie or prior access is required, making network-level blocking of the /monitor path the primary control. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
HackerOne
Remote Code Execution (RCE) in a DoD website
hackerone·2019-10-08·CVSS 9.8
[CRITICAL] Remote Code Execution (RCE) in a DoD website
Remote Code Execution (RCE) in a DoD website
SUMMARY:
The DoD **`https://███/psc/EXPROD/`** Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution (RCE) and Denial of Service Attacks (DoS) over a Java Object Deserialization (CWE-502) in the “monitor” service. Thus an attacker can generate and send malicious java objects of special types to your system and achieve arbitrary effects (such as RCE os DoS) during their deserialization (the objects are deserialized by readObject() method without any type of validation). This is related to CVE-2017-10366 [1].
PROOF OF CONCEPT
For PoC I sent a special serialized java object in order to force the vulnerable server to perform a DNS Lookup for a domain controlled by me (dod.jexboss.info). In this way, if the c
HackerOne
Remote Code Execution (RCE) in a DoD website
hackerone·2019-10-08·CVSS 9.8
[CRITICAL] Remote Code Execution (RCE) in a DoD website
Remote Code Execution (RCE) in a DoD website
SUMMARY:
This report describes a vulnerability similar to that described in my other reports #329376, #329397, #329399
The DoD **`https://████/psc/EXPROD/`** Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution (RCE) and Denial of Service Attacks (DoS) over a Java Object Deserialization (CWE-502) in the “monitor” service. Thus an attacker can generate and send malicious java objects of special types to your system and achieve arbitrary effects (such as RCE os DoS) during their deserialization (the objects are deserialized by readObject() method without any type of validation). This is related to CVE-2017-10366 [1].
PROOF OF CONCEPT
For PoC I sent a special serialized java object in order to force the v
HackerOne
Remote Code Execution (RCE) in a DoD website
hackerone·2019-10-08·CVSS 9.8
[CRITICAL] Remote Code Execution (RCE) in a DoD website
Remote Code Execution (RCE) in a DoD website
SUMMARY:
The DoD **`https://██████/psc/EXPROD_1/`** Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution (RCE) and Denial of Service Attacks (DoS) over a Java Object Deserialization (CWE-502) in the “monitor” service. Thus an attacker can generate and send malicious java objects of special types to your system and achieve arbitrary effects (such as RCE os DoS) during their deserialization (the objects are deserialized by readObject() method without any type of validation). This is related to CVE-2017-10366 [1].
PROOF OF CONCEPT
For PoC I sent a special serialized java object in order to force the vulnerable server to perform a DNS Lookup for a domain controlled by me (testing1.jexboss.info). In this way
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/101455http://www.securitytracker.com/id/1039598https://www.exploit-db.com/exploits/43594/http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/101455http://www.securitytracker.com/id/1039598https://www.exploit-db.com/exploits/43594/
2017-10-19
Published