Hello friends,
This is my first write-up: how I found and exploited CVE-2022-21500, a vulnerability in Oracle E-Business Suite, during bug bounty testing, and how it exposed a company’s employee data.
Let’s start!
1- I was using the Shodan search engine to look for IP addresses belonging to a company in a bug bounty program.
hostname:target.com
During my search I found an interesting IP which belongs to the target.com
2- Then I passed this IP to Nuclei to discover the Vulnerabilities.
nuclei -u https://TARGET-IP
3- Nuclei detected:
[CVE-2022-21500] [http] [high] https://TARGET-IP/OA_HTML/ibeCAcpSSOReg.jsp
I then researched CVE-2022-21500: what it is and how it can be exploited.
Here is the exploitation process that exposed the employee data.
1- Opened this URL in the browser: https://TARGET-IP/OA_HTML/ibeCAcpSSOReg.jsp
Clicked on Register as individual
Filled in the required details with my own email account and submitted the form.
2- Immediately after submitting, I received a confirmation email with login credentials.
I logged in with those credentials and had access to the internal portal.
3- Clicked on the Settings icon > Manage Proxies
4- Clicked Run Proxy Report.
5- On Username Box: typed any single letter (a, b, c … z).
6- Changed the existing date and clicked the search icon next to the Username box.
7- The report immediately returned employee details. Changing the letter returned more records, so the full employee list was exposed.
After seeing this data, I reported the issue to the program.
Status: Duplicate (another researcher had already reported the same issue).
How to fix it: Oracle released a fix for CVE-2022-21500 in a Security Alert (linked below). Organisations running Oracle E-Business Suite should apply it, and should not expose self-registration and other EBS pages to the internet unless they are needed.
References:
https://www.oracle.com/security-alerts/alert-cve-2022-21500.html
I hope you liked it.
Thanks for reading!
Connect With Me!
