Unauthenticated Local File Inclusion in Oracle PeopleSoft Enterprise

CVE-2023-22047 is a critical, unauthenticated Local File Inclusion (LFI) vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools versions 8.59 and 8.60. The vulnerability stems from improper input validation within the Updates Environment Management component, specifically the /RP endpoint. An attacker can exploit this via the wsrp-url query parameter to read arbitrary files from the underlying server filesystem. Successful exploitation requires no authentication and enables the theft of sensitive information, including database credentials, WebLogic administrative credentials, system configuration files, environment variables, and password hashes. Public proof-of-concept exploit code is available, heightening the risk of exploitation.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Oracle PeopleSoft Enterprise instances.
2. Attacker crafts a malicious HTTP GET request targeting the /RP endpoint.
3. The request includes a crafted wsrp-url parameter containing the path to a sensitive file (e.g., /etc/passwd or application configuration files).
4. The PeopleSoft PeopleTools application fails to validate the parameter, interpreting the input as a file system path.
5. The application processes the request and accesses the file on the server filesystem.
6. The server returns the contents of the requested file in the HTTP response body to the attacker.
7. Attacker parses the returned data to extract credentials, hashes, or configuration secrets to facilitate further system compromise.

Impact

Successful exploitation allows unauthenticated attackers to read any file on the server accessible by the service account. This frequently results in full system compromise via the acquisition of database and administrative credentials, potentially leading to unauthorized data exfiltration or lateral movement within the enterprise environment.

Recommendation

1. Patch Oracle PeopleSoft Enterprise PeopleTools by upgrading to a secured version as specified by Oracle security advisories for CVE-2023-22047.
2. Deploy the provided Sigma rule to monitor for suspicious GET requests containing path traversal sequences or sensitive file paths in the wsrp-url parameter.
3. Implement network-level access controls to restrict access to the /RP endpoint to only authorized internal IP ranges.
4. Review web server and application logs for anomalous requests to the /RP path containing the wsrp-url parameter.