id: CVE-2021-35587

info:
  name: Oracle Access Manager - Remote Code Execution
  author: cckuailong
  severity: critical
  description: |
    The Oracle Access Manager  portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.
  reference:
    - https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316
    - https://nvd.nist.gov/vuln/detail/CVE-2021-35587
    - https://www.oracle.com/security-alerts/cpujan2022.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-35587
    cwe-id: CWE-502
    cpe: cpe:2.3:a:oracle:access_manager:*:*:*:*:*:*:*:*
    epss-score: 0.97166
  metadata:
    max-request: 1
    verified: true
    fofa-query: body="/oam/pages/css/login_page.css"
    shodan-query: http.title:"Oracle Access Management"
  tags: cve,cve2021,oam,rce,java,unauth,oracle,kev

http:
  - method: GET
    path:
      - '{{BaseURL}}/oam/server/opensso/sessionservice'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "x-oracle-dms-ecid"
          - "x-oracle-dms-rid"
        condition: or
        case-insensitive: true

      - type: word
        part: body
        words:
          - "/oam/pages/css/general.css"

# Enhanced by mp on 2022/05/02