The document summarizes 0-day vulnerabilities found in Oracle E-Business Suite. The researcher discovered 12 remotely exploitable vulnerabilities that allowed unauthenticated access and ability to create, delete or modify critical data. Specific vulnerabilities are detailed for components like Customer Interaction History and CRM Technical Foundation. Screenshots demonstrate exploitation of the vulnerabilities. The vulnerabilities stem from design issues like default user accounts having excessive privileges and lack of access controls on files like HTML and XML. While WAFs could block the vulnerabilities, they did not block all file types leaving issues. Remediation includes applying patches, removing unused files, strengthening WAF rules, and securing default accounts.

1. 0-day Vulnerabilities on
Oracle E-Business Suite
Suraj Khetani
Regional Associate Security Consultant
Gulf Business Machines

2. #uname -a
• Security Consultant/Penetration tester
• Former Hip-hop Dance instructor
• Fitness Enthusiast
• Cricket lover; Played for UAE under-14
• Learner

3. Topics
• Oracle EBS Overview
• Attack surface
• Overview of the vulnerability
• Details about the vulnerabilities
• How they were found
• Issue with Design
• Issues found with WAF
• Mitigating the vulnerabilities with and without a WAF

4. E-Business Suite
Overview
• Suite of business applications such as ERP, CRM, SCM
• Processes data for HR, Finance, etc
• Used by medium to large enterprises
• Oracle claims they have a robust security program
• Huge attack surface!!!

5. Attack Surface
• 10,000 JSPs
• 4,000 html forms
• Multiple other types of files like XML, DTD, etc
• Oracle EBS application has 40 default user accounts.
• Oracle EBS database has 300 default user accounts.
• Number of default accounts increase with every new
module

6. Vulnerability Overview
• OWASP top 10 - Missing Function Level Access
Control/Broken Access Controls
• Ability to access to JSPs, forms and xml files without
authentication
• 21 vulnerabilities on EBS in Oct CPU.
• Found 12 of the 14 remotely exploitable vulns

7. Vulnerability Details
• Unauthenticated access to create, delete, modify data
• Components affected:
• Oracle Shipping Execution (subcomponent: Workflow Events).
• Oracle Common Applications Calendar (subcomponent: Resources Module)
• Oracle One-to-One Fulfillment (subcomponent: File Upload)
• Oracle Interaction Center Intelligence (subcomponent: Select Application
Dependencies).
• Oracle Email Center (subcomponent: Dispatch/Service Call Requests)
• Oracle CRM Technical Foundation (subcomponent: Responsibility
Management).
• Oracle Customer Interaction History (subcomponent: Outcome-Result,
Result-Reason, and Outcome-Result).
• Oracle CRM Technical Foundation (subcomponent: Default Responsibility)

8. CVE’s
• CVE-2016-5532, CVE-2016-5575, CVE-2016-5583,
CVE-2016-5585, CVE-2016-5586, CVE-2016-5587,
CVE-2016-5589, CVE-2016-5591, CVE-2016-5592,
CVE-2016-5593, CVE-2016-5595, CVE-2016-5596

9. Advisory
• CVE-2016-5587 - Vulnerability in the Oracle Customer
Interaction History component of Oracle E-Business Suite
(subcomponent: Outcome-Result). Successful attacks of this
vulnerability can result in unauthorized creation, deletion or
modification access to critical data or all Oracle Customer
Interaction History accessible data as well as unauthorized
read access to a subset of Oracle Customer Interaction History
accessible data.
• Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3,
12.2.3 and 12.2.4.
• CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity
impacts).

10. Advisory
• CVE-2016-5589 - Vulnerability in the Oracle CRM Technical
Foundation component of Oracle E-Business Suite
(subcomponent: Responsibility Management). Successful
attacks of this vulnerability can result in unauthorized creation,
deletion or modification access to critical data or all Oracle
CRM Technical Foundation accessible data as well as
unauthorized read access to a subset of Oracle CRM Technical
Foundation accessible data.
• Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3,
12.2.3, 12.2.4, 12.2.5 and 12.2.6.
• CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity
impacts).

11. Screenshots

12. Screenshots

13. Screenshots

14. Screenshots

15. Screenshots

16. Screenshots

17. Screenshots

18. Screenshots

19. Screenshots

20. Screenshots

21. Screenshots (David Litchfiled)

22. How I found
• Live Demo

23. Product Design Issue
• Default user account - GUEST.
• Anonymous user = GUEST privilege.
• GUEST account Authorized to access any servlets meant
to be used for authenticated users

24. Broken Access Controls
vs WAF
• WAFs have ability to block broken access controls
• Successfully blocking the 0-days on EBS
• Did not block files with extensions HTML, XML, DTD,
etc

25. WAF Blocking the Vuln

26. Remediation
• Apply Patches
• Remove unwanted/unused servlets, forms, etc
• Fine tune WAFs to block unauthenticated access to files
other than JSP like HTML, XML
• Identify default user accounts and change their passwords

27. Questions?