支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: ea23c1453011debaee8dd6a42bb106bb33f829ec

来源
https://github.com/tuo4n8/CVE-2023-22047
关联漏洞
标题:Oracle PeopleSoft Enterprise PeopleTools 安全漏洞 (CVE-2023-22047)
Description:Oracle PeopleSoft Enterprise PeopleTools是美国甲骨文（Oracle）公司的用于为 PeopleSoft 应用程序提供与用户的需求和期望保持同步的技术。 Oracle PeopleSoft 的 PeopleSoft Enterprise PeopleTools product 存在安全漏洞，该漏洞源于 Portal 模块允许未经身份验证的攻击者通过 HTTP 进行网络访问来危害 PeopleSoft Enterprise PeopleTools。成功攻击此漏洞可能会导
Description
Leveraging arbitrary file read to RCE on Oracle PeopleSoft
介绍
## Description:
- CVE-2023-22047 is unauthentication read file on oracle-peoplesoft. However, advance exploit attacker can use this vulnerability to execute remote code execution.

- In the peoplesoft application "Portal.war"," Serlet "WSRP Consumer ResourceProxy" enables the ability to read files and make request (SSRF) to any host.

- With this vulnerability, attackers can easily achieve Remote Code Execution (RCE) on the affected server, indicating that the actual severity exceeds the assigned CVSS score.

## Step to Exploit

```
https://peoplesoft.local:8443/RP?wsrp-url=file:///etc/passwd
https://peoplesoft.local:8443/RP?wsrp-url=file:///c:\\windows\\win.ini
```

```bash
echo target | nuclei -t CVE-2023-22047.yaml
```

![read-file](asset/read-file.png)

## Step to RCE:
- By default, Oracle PeopleSoft enables the RESTful Management Services on WebLogic. Therefore, leveraging the SSRF vulnerability, attackers can easily retrieve full HTTP responses, ultimately allowing them to achieve Remote Code Execution (RCE).

- Step 1:  Read `SerializedSystemIni.dat` and `credentials` of weblogic server. Decypt it  to get raw secret.

- Step 2: Use `RESTAPI Management` to deploy webshell to weblogic


![unauthen-rce](asset/rce.png)


## Old story:
- Initially, I submitted this vulnerability to ZDI, but unfortunately, they weren't interested in this product 🥲. After a long time, I reported it directly to Oracle, but it was marked as a duplicate of CVE-2023-22047.

- Despite its CVSS score of only 7.5, this vulnerability is extremely critical, as attackers can exploit it to achieve unauthenticated Remote Code Execution (RCE).
文件快照

 [4.0K]  /data/pocs/ea23c1453011debaee8dd6a42bb106bb33f829ec
├── [4.0K]  asset
│   ├── [103K]  rce.png
│   └── [ 79K]  read-file.png
├── [1.5K]  CVE-2023-22047.yaml
└── [1.6K]  README.md

1 directory, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。