SRC-2019-0014 : Oracle Application Testing Suite UploadServlet External Entity Injection Information Disclosure Vulnerability



CVSS Score:

6.5, (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Vendors:


Affected Products:

Application Testing Suite

Vulnerability Details:

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Oracle Application Testing Suite. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UploadServlet servlet. Due to the improper restriction of XML External Entity (XXE) reference, a specially crafted multipart request causes the XML parser to access the contents of an attacker controlled URI and embed these contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose sensitive information under the context of the SYSTEM.

Vendor Response:

Oracle has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline:

  • 2018-10-02 – Verified and acquired by iDefense
  • 2019-01-15 – Coordinated public release of advisory


This vulnerability was discovered by Steven Seeley (mr_me) of Source Incite


Source Incite would like to acknowledge iDefense's Vulnerability Contributor Program for the help with co-ordination of this vulnerability.