Overview

CVE-2022-21445 (CVSS 9.8), a vulnerability is an untrusted data deserialization, identified in the ADF Faces component, which can be exploited remotely by attackers without authentication (pre-authentication) to perform RCE.

This vulnerability was discovered by two cybersecurity experts: PeterJson from VNG Corporation and Nguyen Jang from VNPT. Oracle received this report in October 2021 and took 6 months, until April 2022, to release the patch.

In this article, exploitation focuses on Oracle Business Intelligence version 12.2.1.4.0.

Analysis - Reproducing the Vulnerability

Environment Setup

Victim/Target Machine Side

Requirements: Install Windows 10+ Pro or Windows Home (x64) with active license, or use Windows Server (Oracle's products are preferred).

Step 1: Install Java, version jdk 8u112 or later (8Ux), download link: JDKv8U112

• Add JAVA_HOME with the path pointing to the jdk directory (not jre).

Step 2: Install Oracle Database 19c, download link: Oracle 19c

1. Prepare a folder for database installation, create a path like below and extract the downloaded database zip file into it: C:\app\oracle\product\19c\db_home1

2. Run setup.application with administrator privileges.

3. Follow each step by step as instructed in DB Installation Guide

4. Important note: At step 8/17, remember to check Create as Container database to open a pluggable database for the upcoming Fusion Middleware installation.

   At step 9/17, select character set as Unicode (AL32UTF8).

5. After the installation is complete, carefully check in Windows Services to ensure that the 4 main services as shown below have RUNNING status.

6. Create a new Oracle database account by following these steps:

• Terminal Administrator -> sqlplus / as sysdba
• Create system user: alter user system identified by system_password account unlock;
• Check existence of system user: select username from dba_users;
• Set environment: alter session set “_oracle_script”=true;
• Create regular user hr: create user hr identified by user_password;
• Grant privileges: grant all privileges to hr;
• Unlock account – change password: alter user hr identified by hr_pass account unlock;
• Create new system account: alter user sys identified by sys_pass account unlock;

Step 3: Install SQL Developer, no-jre version, download link: SQLDev-NoJRE

• Run sqldeveloper.application with administrator privileges.

• Configure parameters for a new connection as shown below, note to change Username and Password (as in the example above: hr), Hostname (default is localhost), Port (default is 1521), SID (the global database name installed in step 2).

• If when selecting Test you see a Success message, the connection is successful; then select Connect.

Step 4: Install Fusion Middleware Infrastructure (FMW) version 12.2.1.3.0, download link: FMW_ver_12.2.1.3.0

• Create a path for the FMW installation directory in the format: C:\Oracle\Middleware\Oracle_Home
• Follow the instructions step by step: FMW Installation Guide

Step 5: Install Oracle Business Intelligence (OBIEE) version 12.2.1.4.0, download link: OBIEE_ver_12.2.1.4.0

• Run setup_bi_platform-12.2.1.4.0_win64.exe with administrator privileges.

• Install step by step according to OBIEE Installation Guide

• Note: The BI path must match the FMW installation path, e.g., Oracle/Middleware/Oracle_Home.

Step 6: Set up BI Schema using the Repository Creation Utility (RCU)

• At the path C:\Oracle\Middleware\Oracle_Home\oracle_common\bin, run rcu.bat as administrator.

• Follow the steps below:

• Finally, click Create to let the system create the BI Schema.

Step 7: Set up environment variables for OBIEE

• Go to Control Panel > System > Advanced system settings > Advanced > Environment Variables > New System Variable

Step 8: Create BI Domain

1. At the path C:\Oracle\Middleware\Oracle_Home\bi\bin, run config.cmd as administrator.

2. In step 1: Select all 3 components, where Essbase is the OLAP server, Business Intelligence Enterprise Edition is BI Analytics, and Business Intelligence Publisher is BI Publisher.

3. In step 3: Configure a new domain as shown below, !! REMEMBER THE DOMAIN PASSWORD BECAUSE IT WILL BE VERY DIFFICULT TO RECOVER. Leave the domain as bi since it's the default.

4. In step 4: Update domain information for the Database.