SRC-2019-0014 : Oracle Application Testing Suite UploadServlet External Entity Injection Information Disclosure Vulnerability
CVE ID:
CVSS Score:
6.5, (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Vendors:
Oracle
Affected Products:
Application Testing Suite
Vulnerability Details:
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Oracle Application Testing Suite. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the UploadServlet servlet. Due to the improper restriction of XML External Entity (XXE) reference, a specially crafted multipart request causes the XML parser to access the contents of an attacker controlled URI and embed these contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose sensitive information under the context of the SYSTEM.
Vendor Response:
Oracle has issued an update to correct this vulnerability. More details can be found at: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Disclosure Timeline:
- 2018-10-02 – Verified and acquired by iDefense
- 2019-01-15 – Coordinated public release of advisory
Credit:
This vulnerability was discovered by Steven Seeley (mr_me) of Source Incite
Acknowledgments:
Source Incite would like to acknowledge iDefense's Vulnerability Contributor Program for the help with co-ordination of this vulnerability.