Open Redirect in Oracle EBS (CVE-2017-3528)

Writeup of my first CVE; An open redirect in Oracle E-Business Suite, patched in April 2017 CPU(CVE-2017-3528)....

a year ago

Latest Post Surviving in the Ring: Expanding Your Horizons by Andy Gill

Well this post is a bit late 12 months to be exact! However better late than never right? This is my first CVE I've been awarded while not a super leetfinding it was still a valid 0-Day at the time.

A bit of background for those of you not aware of open redirect issues, an open redirect is a security flaw in an app or a web page that causes it to fail to properly authenticate URLs. As a result it is possible to supply arbritary links for the app to redirect to.

This issue in particular affects Oracle E-Business Suite 12.1.3/12.2.x, in order to trigger the exploit the following url can be used:

https://targetsite/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=/\example.com

Where the redirect parameter is vulnerable and if you supply any URL within /\zsec.uk the page will be rendered inside of the site. Which is similar to an iframe or open redirect:

EBS

The affected URL and payload have been highlighted above for visual purposes, this has since been patched as of April 2017 in the CPU. The issue also has an entry on Exploit DB here.

Andy Gill

Published a year ago

Subscribe to our newsletter

Recieve news directly to your email.

ZeroSec - Adventures In Information Security © 2019.