Patchfirst
Patchfirst
CVE-2021-35587 KEVPublic exploit Critical · 9.8 EPSS 96.3%

Oracle Fusion Middleware Unspecified Vulnerability

Oracle · Fusion Middleware

Summary

The flaw lies in the OpenSSO Agent component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over HTTP can easily exploit it, with no user interaction required, to take over Oracle Access Manager.

Official description · NVD

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Breakdown
73.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 10 months after disclosure. Public exploit code (Metasploit) was available the same day.

  1. DisclosedPublic exploit codeMetasploitday 0
  2. First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees+10 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Unauthenticated HTTP exploitation of exposed service

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Takeover implies code execution on server

Successful attacks of this vulnerability can result in takeover of Oracle Access Manager
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-35587 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportEclecticIQ

Reports are matched by finding the exact id CVE-2021-35587 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

oracle.com/security-alerts/cpujan2022.html

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587
↑ ↓ chooseEnter openEsc close