SRC-2019-0014 : Oracle Application Testing Suite UploadServlet External Entity Injection Information Disclosure Vulnerability
Application Testing Suite
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Oracle Application Testing Suite. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the UploadServlet servlet. Due to the improper restriction of XML External Entity (XXE) reference, a specially crafted multipart request causes the XML parser to access the contents of an attacker controlled URI and embed these contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose sensitive information under the context of the SYSTEM.
Oracle has issued an update to correct this vulnerability. More details can be found at: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- 2018-10-02 – Verified and acquired by iDefense
- 2019-01-15 – Coordinated public release of advisory
This vulnerability was discovered by Steven Seeley (mr_me) of Source Incite
Source Incite would like to acknowledge iDefense's Vulnerability Contributor Program for the help with co-ordination of this vulnerability.