adityabhatt3010/cve-2025-61882-oracle-e-business-suite-pre-auth-rce-exploitA critical pre-authentication Remote Code Execution (RCE) flaw in Oracle E-Business Suite (versions 12.2.3 - 12.2.14) allows attackers to gain full control over vulnerable servers via malicious HTTP requests - now actively exploited in the wild.
CVE-2025-61882 is a critical, pre-auth RCE in Oracle E-Business Suite (EBS) actively exploited in extortion/data-theft campaigns. Affected versions: 12.2.3 → 12.2.14. Oracle published an emergency advisory with IOCs (IPs, shell-stager command, SHA-256s). Patch or shield exposed systems immediately, hunt with the provided detections, and use the safe Python script below to scan logs. Don’t run public PoCs on production — test only in an isolated lab with authorization. 🛑🗿
Oracle EBS runs critical business functions (ERP, payroll, finance, HR). A pre-auth RCE in a web-facing EBS instance allows an attacker to execute arbitrary commands on the application server, potentially access sensitive data, drop webshells, and exfiltrate files. This vulnerability was weaponized in the wild and tied to extortion campaigns — it’s a real business incident, not a theoretical CVE. 🔥
/OA_HTML/ flows, and related endpointsUiServlet and /OA_HTML/ to trigger RCE./bin/bash -i >& /dev/tcp/...).Oracle notes these IOCs are observed activity across incidents (not limited to CVE-2025-61882). Treat any positive match as high priority.
IPs
200.107.207.26 — Potential GET/POST activity185.181.60.11 — Potential GET/POST activityShell stager pattern
sh -c /bin/bash -i >& /dev/tcp// 0>&1 — observed outbound TCP reverse shell style commandSHA-256 hashes (exploit / PoC artifacts)
76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d
(oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip)aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121
(.../exp.py)6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b
(.../server.py)Affected versions (repeat for emphasis)
TL;DR The GitHub Repo contains passive detection artifacts for CVE-2025-61882 (Oracle E-Business Suite pre-auth RCE). Use these to hunt, triage, and contain — not to exploit. 🛑🗿
A brief Description.md (mini-README) has already been added inside the detections/ folder — check that file for the full writeup and TL;DR. This top-level README only summarizes the detection pack and usage so you can grab and run things quickly.
detections/splunk/
oracle_cve61882_ioc_traffic.spl — Detect traffic to/from Oracle-provided IOC IPs.oracle_cve61882_uiservlet_post.spl — Detect suspicious POSTs to UiServlet / /OA_HTML/ from external IPs.oracle_cve61882_reverse_shell.spl — Detect reverse-shell style process creation in endpoint logs.detections/elastic/
oracle_cve61882_uiservlet_post.kql — KQL for UiServlet/OA_HTML POSTs.oracle_cve61882_filehash_detection.kql — KQL to match Oracle-provided malicious SHA-256s.detections/scripts/
ebs_safe_hunt.py — Safe, offline Python log parser (no network calls, no exploit execution). Run against copies of your access logs.Review detections/Description.md for context and IOCs. ✅
Drop the Splunk .spl queries into your Splunk environment (or import them into saved searches / alerts).
Paste the KQL queries into Kibana / Elastic detection rules.
Copy ebs_safe_hunt.py to a host that only has read access to archived or redacted logs, then run:
python3 ebs_safe_hunt.py /path/to/access.log
Review flagged malicious_ips, servlet_posts, shell_stager, and malicious_hash outputs and escalate as needed. 🕵️♂️
Principle: combine version disclosure or UI hits with high-confidence indicators (malicious IPs, POST to UiServlet/OA_HTML, reverse shell process strings, file hash matches, large outbound uploads).
Splunk examples Detect traffic to Oracle IOCs:
index=web_logs OR index=proxy_logs
| where clientip IN ("200.107.207.26","185.181.60.11") OR dest_ip IN ("200.107.207.26","185.181.60.11")
| stats count by clientip, dest_ip, uri, method, useragent, _time
| sort - count
Detect UiServlet/OA_HTML POSTs from external IPs:
index=web_logs sourcetype=access_combined
| where (uri LIKE "%UiServlet%" OR uri LIKE "%/OA_HTML/%") AND method="POST"
| where NOT cidrmatch("10.0.0.0/8", clientip) // adjust for your internal ranges
| stats count by clientip, uri, useragent, _time
| sort - count
Detect reverse shell process creation (EDR):
index=endpoint_events sourcetype=os_process
| where process_cmdline LIKE "%/bin/bash -i%/dev/tcp/%" OR process_cmdline LIKE "%/dev/tcp//%"
| table _time host user process_name process_cmdline parent_process
Elastic / KQL examples UiServlet suspicious POST:
http.request.method : "POST" and (http.request.uri : "*UiServlet*" or http.request.uri : "/OA_HTML/*") and not client.ip : ("10.0.0.0/8")
File hash detection:
event.type: "file" and file.hash.sha256 : ("76b6d36e04e3...", "aa0d3859d66...", "6fd538e4a8e3...")
Sigma (portable rule ideas)
UiServlet//OA_HTML/ from external IPs → high priority/bin/bash -i >& /dev/tcp/ → criticalThis script parses web access logs in combined format and flags suspicious UiServlet/OA_HTML POSTs, requests from Oracle-listed malicious IPs, shell stager patterns, and occurrences of the provided SHA-256 hashes. It does not perform any network activity or run exploit code.
#!/usr/bin/env python3
"""
ebs_safe_hunt.py — Safe log parser for CVE-2025-61882 indicators.
Usage:
python3 ebs_safe_hunt.py /path/to/access.log
Notes:
- Parses Apache/Nginx combined log lines.
- Flags UiServlet/OA_HTML POSTs, malicious IPs from Oracle advisory,
shell stager patterns, and observed SHA256 hashes.
- Safe: no network / no exploit execution.
"""
import sys
import re
from collections import Counter, defaultdict
# Regex for common combined log format
LOG_PATTERN = re.compile(
r'(?P<ip>\S+) \S+ \S+ \[(?P<time>.*?)\] "(?P<method>\S+) (?P<uri>\S+) \S+" (?P<status>\d{3}) (?P<size>\S+) "(?P<ref>[^"]*)" "(?P<ua>[^"]*)"'
)
# Oracle-provided IOCs
MALICIOUS_IPS = {"200.107.207.26", "185.181.60.11"}
MALICIOUS_HASHES = {
"76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d",
"aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121",
"6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b",
}
SHELL_PATTERN = "/bin/bash -i" # we search for this substring (reverse shell style)
SUSPICIOUS_PATHS = ["UiServlet", "/OA_HTML/"]
# Optional: list of suspicious user-agents often used by scanners
SUSPICIOUS_UAS = ["curl", "wget", "python-requests", "nikto", "sqlmap", "masscan", "Nmap"]
def analyze_log(path):
ip_counts = Counter()
uri_counts = Counter()
ua_counts = Counter()
suspicious = defaultdict(list)
with open(path, "r", errors="replace") as fh:
for line_no, line in enumerate(fh, 1):
m = LOG_PATTERN.search(line)
if not m:
# Optionally, still check for hashes or shell pattern in unstructured lines
if any(h in line for h in MALICIOUS_HASHES):
suspicious["malicious_hash_lines"].append((line_no, line.strip()))
if SHELL_PATTERN in line or "/dev/tcp/" in line:
suspicious["shell_pattern_lines"].append((line_no, line.strip()))
continue
ip = m.group("ip")
method = m.group("method")
uri = m.group("uri")
ua = m.group("ua")
size = m.group("size")
ip_counts[ip] += 1
uri_counts[uri] += 1
ua_counts[ua] += 1
# 1) Malicious IPs (Oracle)
if ip in MALICIOUS_IPS:
suspicious["malicious_ips"].append((line_no, ip, method, uri, ua))
# 2) POSTs to suspicious EBS paths
if method.upper() == "POST" and any(p in uri for p in SUSPICIOUS_PATHS):
suspicious["servlet_posts"].append((line_no, ip, uri, ua))
# 3) Suspicious user agents (scanners)
if any(k.lower() in ua.lower() for k in SUSPICIOUS_UAS):
suspicious["suspicious_ua"].append((line_no, ip, uri, ua))
# 4) Very large responses (possible exfil) — tune threshold for your environment
try:
if size != "-" and int(size) > 5_000_000: # >5MB
suspicious["large_responses"].append((line_no, ip, uri, size))
except ValueError:
pass
# 5) Shell stager pattern or /dev/tcp patterns in the line
if SHELL_PATTERN in line or "/dev/tcp/" in line:
suspicious["shell_stager"].append((line_no, ip, uri, line.strip()))
# 6) Known malicious file hashes present in logs (if available)
for h in MALICIOUS_HASHES:
if h in line:
suspicious["malicious_hash"].append((line_no, ip, uri, h))
return {
"ip_counts": ip_counts,
"uri_counts": uri_counts,
"ua_counts": ua_counts,
"suspicious": suspicious
}
def pretty_report(r, top=10):
print("\n=== EBS HUNT REPORT ===\n")
print("Top source IPs:")
for ip, c in r["ip_counts"].most_common(top):
print(f" {ip}: {c}")
print("\nTop URIs:")
for uri, c in r["uri_counts"].most_common(top):
print(f" {uri}: {c}")
print("\nTop User-Agents:")
for ua, c in r["ua_counts"].most_common(top):
print(f" {ua}: {c}")
print("\nSuspicious findings:")
if not r["suspicious"]:
print(" None found.")
return
for k, items in r["suspicious"].items():
print(f"\n-- {k} ({len(items)} matches) --")
for item in items[:100]:
print(" " + " | ".join(map(str, item)))
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python3 ebs_safe_hunt.py /path/to/access.log")
sys.exit(1)
path = sys.argv[1]
result = analyze_log(path)
pretty_report(result)
How to use: copy ebs_safe_hunt.py to a host that has read access to archived or copied logs. Run:
python3 ebs_safe_hunt.py /path/to/access.log
Review flagged malicious_ips, servlet_posts, shell_stager, and malicious_hash results and escalate appropriately. 🕵️♂️
200.107.207.26 and 185.181.60.11 and any other vendor-supplied IOC IPs/domains.Subject: Critical: CVE-2025-61882 — Oracle E-Business Suite — Immediate action required
What: Critical pre-auth RCE (CVE-2025-61882) in Oracle EBS (12.2.3–12.2.14). Exploited in data-theft/extortion campaigns.
Immediate asks (next 24 hours):
Risk: High — potential full application server compromise, data exfiltration, regulatory exposure. Bottom line: patch or shield now. — 🗿
You’ve got everything you need: the overview, IOCs straight from Oracle, practical hunts, and a safe script to kick off triage. Patch or shield your EBS boxes, blast the IOC hunts through your SOC, and isolate anything that looks sketchy. Stay sharp, patch fast, and flex that incident-response muscle. 🗿🔥
detections/Description.md