• Search for:
    3Oct, 2022
    Oracle cloud bug allowed accessing other users’ virtual disks

    Severe Oracle cloud vulnerability allowed researchers to access Oracle’s virtual disk that did not belong to them.

    The severe Oracle Cloud Infrastructure (OCI) flaw, dubbed #AttachMe, was discovered by researchers at security firm Wiz. According to Shir Tamari, the head of Wiz’s research, not only could attackers access the virtual drive but also write over it.

    “When trying to attach to another OCI user’s virtual disk, we were surprised to find the operation succeeded! We received read/write access to disks in another account that does not belong to us,” Tamari said in a Tweet.

    He explained that each virtual disk in Oracle’s cloud has a unique identifier that no one considers secret. However, an attacker with the identifier could access the virtual disk, given it was not attached to an active server at the time of the attack.

    The root cause of the flaw, Tamari said, was the lack of permission verification in one of the application programming interfaces (API).

    While Oracle fixed the flaw the same day Wiz reported, Tamari noted that this was the first time he encountered a cross-tenant vulnerability in a cloud service provider’s infrastructure.

    “Customers expect that their data isn’t accessible by other customers. Yet, cloud isolation vulnerabilities break the walls between tenants. This highlights the crucial importance of proactive cloud vulnerability research […],” reads Wiz’s blog post.

    The disclosure comes a month after another company from the Oracle family, the data broker Oracle America, has been served with a class-action lawsuit over alleged privacy violations.

    The lawsuit accuses the company of selling “detailed personal information to third parties” both directly and via its ID Graph function, “a service product designed to provide ‘identity resolution,’ the process of ‘matching individual customer identities and combining them into a single consistent and accurate customer profile.’”

    Resource : https://cybernews.com/news/oracle-cloud-bug-allowed-accessing-other-users-virtual-disks/

    28Jun, 2022
    Information Security News

    Oracle spent 6 months to fix ‘Mega’ flaws in the Fusion Middleware

    Researchers have disclosed technical details of a critical flaw in Fusion Middleware, tracked as CVE-2022–21445, that Oracle took six months to patch.

    Security researchers have published technical details of a critical Fusion Middleware vulnerability, tracked as CVE-2022–21445, that was reported to Oracle by researchers Peter son of VNG Corporation and Nguyen Jang of VNPT in October 2021. The flaw was addressed by the IT giant six months later with the release of its April 2022, Critical Patch Update.

    The vulnerability resides in the ADF Faces component, it is the de-serialization of untrusted data that could lead to arbitrary code execution.

    The security duo described the issue as a “mega flaw” that impacts all applications relying on ADF Faces, including Business Intelligence, Enterprise Manager, Identity Management, SOA Suite, Web Center Portal, Application Testing Suite, and Transportation Management. The duo named their attack “The Miracle Exploit.”

    “Now after a period of time after Oracle released the patch, we decided to publish this blog to share the details of Miracle exploit.” We very very excited at the time (6 months ago), but now we don’t have that feeling any more because Oracle took too long to patch this vulnerability, more than the standard.” reported the security duo in blog post. “Anyway, this is a cool exploit, a cool story me and Jang worked together in a month, so let we tell you about our story.”

    The researchers also discovered a server-side request forgery (SSRF) vulnerability, tracked as CVE-2022–21497. This issue could be chained with CVE-2022–21445 to achieve pre-authentication remote code execution in Oracle Access Manager.

    “In the demonstration we sent to Oracle, we chose edelivery.oracle.com , business net work.oracle.com which are popular for user to download Oracle’s products, and this site is based on ADF Faces framework.” concludes the experts. “Last but not least, we successfully achieved pre-auth RCE on login.oracle.com which plays an important role in Oracle’s online services.”

    “Why we hack some Oracle’s sites? Because we want to demonstrate the impact to Oracle and let them know this vulnerability is super dangerous , it affects both Oracle’s systems and Oracle’s customers. That’s why we want Oracle take an action ASAP. But as you can see, 6 months for Oracle to patch it, I don’t know why, but we have to accept it and follow Oracle’s policy.” they added.

    Resource: https://securityaffairs.co/wordpress/132603/breaking-news/oracle-mega-flaw-cve-202221445.html