Oracle Reports Server Unauthorized Report Execution Vulnerability
BID:14316
Info
Oracle Reports Server Unauthorized Report Execution Vulnerability
| Bugtraq ID: | 14316 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 19 2005 12:00AM |
| Updated: | Jul 19 2005 12:00AM |
| Credit: | Alexander Kornbrust <[email protected]> discovered this vulnerability. |
| Vulnerable: |
Oracle Oracle Reports6i 6.0.8 .19 Oracle Oracle Reports6i 6.0.8 Oracle Oracle Reports 9i Oracle Oracle Reports 6 Oracle Oracle Reports 10g 9.0.4 .3.3 Oracle Oracle Reports 10g 9.0.4 Oracle Oracle Reports 10g 9.0.3 Oracle Oracle Reports 10g 9.0.2 Oracle Oracle Reports 10g 9.0.1 Oracle Oracle Reports 10g 9.0 |
| Not Vulnerable: | |
Discussion
Oracle Reports Server Unauthorized Report Execution Vulnerability
Oracle Reports Server is susceptible to an unauthorized report execution vulnerability.
By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected servlet containing the full path of the file.
Attackers may exploit this vulnerability to execute arbitrary commands, or read/write arbitrary files with the privileges of the Oracle account under which the server is executing.
It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access.
Oracle Reports Server is susceptible to an unauthorized report execution vulnerability.
By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected servlet containing the full path of the file.
Attackers may exploit this vulnerability to execute arbitrary commands, or read/write arbitrary files with the privileges of the Oracle account under which the server is executing.
It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access.
Exploit / POC
Oracle Reports Server Unauthorized Report Execution Vulnerability
An exploit is not required.
An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com:7779/reports/rwservlet?server=repserv+report=/tmp/hacker.rdf+destype=cache+desformat=PDF
An exploit is not required.
An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com:7779/reports/rwservlet?server=repserv+report=/tmp/hacker.rdf+destype=cache+desformat=PDF
Solution / Fix
Oracle Reports Server Unauthorized Report Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Oracle Reports Server Unauthorized Report Execution Vulnerability
References:
References:
- Oracle Reports 10g Home Page (Oracle)
- Run any OS Command via unauthorized Oracle Reports (Red-Database-Security GmbH)
- Oracle Security Advisory: Run any OS Command via unauthorized Oracle Reports ([email protected])