CVE-2022-21392 PoC — Oracle Enterprise Manager Base Platform 安全漏洞

Source

https://github.com/mbadanoiu/CVE-2022-21392

Associated Vulnerability

Title:Oracle Enterprise Manager Base Platform 安全漏洞 (CVE-2022-21392)
Description:Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Description

CVE-2022-21392: Local Privilege Escalation via NMR SUID in Oracle Enterprise Manager

Readme

# CVE-2022-21392: Local Privilege Escalation via NMR SUID in Oracle Enterprise Manager 

In Oracle installations, where the “nmr” binary is present and SUID-ed as “root”, due to insecure directory permissions, the “oracle” user can elevate his/her privileges to that of the “root” user by replacing the “nmr_macro_list” file.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://www.oracle.com/security-alerts/cpujan2022.html).

### Requirements:

This vulnerability requires:
<br/>
- Access on the local system as the "oracle" user (e.g. executing arbitrary Java code via a compromised Oracle Database)

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2022-21392/blob/main/Oracle%20Enterprise%20Manager%20-%20CVE-2022-21392.pdf).

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!