CVE-2023-22047

published 2023-07-18

CVE-2023-22047: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and…

Priority P2 77 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	peoplesoft_enterprise	—	—
oracle	peoplesoft_enterprise	—	—
oracle_corporation	peoplesoft_enterprise_pt_peopletools	—	—
oracle_corporation	peoplesoft_enterprise_pt_peopletools	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /RP?wsrp-url=file:///etc/passwd

url /RP?wsrp-url=file:///c:\windows\win.ini

path /RP

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Oracle PeopleSoft Unauthenticated File Read (CVE-2023-22047)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/RP|3f|"; content:"wsrp-url|3d|file|3a 2f 2f|"; fast_pattern; reference:url,github.com/tuo4n8/CVE-2023-22047; reference:cve,2023-22047; classtype:web-application-attack; sid:2061733; rev:1; metadata:affected_product Oracle_PeopleSoft, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_18, cve CVE_2023_22047, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit requests are unauthenticated HTTP GET to /RP with the wsrp-url parameter set to a file:// URI (e.g. file:///etc/passwd on Linux, file:///c:\windows\win.ini on Windows). Match both the path and the file:// scheme in the parameter.
• → Successful exploitation returns HTTP 200 with Content-Type 'content/unknown' and file contents in the body. On Linux, match regex root:.*:0:0: ; on Windows match the string 'bit app support'.
• → Use Shodan/FOFA/Google dorks to identify exposed PeopleSoft instances before probing: shodan-query 'http.title:"oracle peoplesoft enterprise"', fofa-query 'title="oracle peoplesoft enterprise"', google-query 'intitle:"oracle peoplesoft enterprise"'.
• → The Emerging Threats Snort/Suricata rule SID 2061733 (rev:1, created 2025-04-18) directly detects this exploit at the network layer for both perimeter and internal deployments, including TLS-decrypted traffic.

• · Affected versions are limited to PeopleSoft Enterprise PeopleTools 8.59 and 8.60 only. Versions outside this range are not affected. ↗
• · The vulnerability is in the Portal component specifically; the wsrp-url parameter fails to validate or restrict file:// scheme URLs, enabling arbitrary local file read.
• · The Nuclei template uses stop-at-first-match across both Linux and Windows payloads, so only one request may be logged per scan attempt — defenders should not expect to see both payloads from a single attacker session.

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vendor_oracle 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306