Hackproofing Oracle Ebusiness Suite
summary
A week of code review on a fully patched 11.5 install finds 21 SQL injection bugs, 26 XSS, two simple DoS vectors and dozens of exploitable JSPs via the PL/SQL Gateway that run as apps user, allowing dbms_sql escalation to CIS/0 and arbitrary OS actions; 12.2 review finds Java deserialization RCE, eight SQLi, XXE, SSRF and directory traversal. Practical fixes: remove unused 15,000 JSPs down to ~200, disable ~700 enabled PL/SQL entries to ~16, and block RF/JSP forwards.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:17Who Am I?
- 1:29eBusiness Suite Overview
- 4:04eBusiness Suite components
- 4:51eBusiness Suite Vulnerabilities
- 6:11Some 11.5 Issues
- 7:24trusted.conf
- 8:08PL/SQL Gateway
- 10:26HR UTIL DISP WEB
- 11:41display_fatal errors
- 12:19Attack Sequence
- 13:49ORACLESSWA
- 14:43RUNFUNCTION
- 15:05Arbitrary SQL
- 16:49Some 12.x Issues
- 19:25Many ways to skin a cat
- 21:50JSP forwards
- 24:00Auxiliary Inject Functions 1/2
- 27:33Executing SQL as SYS
- 32:11SQL Injection in SYSTEM.AD_APPS PRIVATE
- 34:24Securing 12.x and 11.5
- 37:50Specific to Securing 11.5
- 38:50Securing eBusiness Suite
- 39:40Questions?
related talks
34mHacking the Oracle Application Framework
51mMaking the most of Security Tests
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
47mThe Hidden Security Hazards in Your Java Stack
43mTop Security Flaws Hiding in Your Code Right Now – and How to Fix Them
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application