Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Oracle PeopleSoft Enterprise instances.
2. Attacker crafts a malicious HTTP GET request targeting the /RP endpoint.
3. The request includes a crafted wsrp-url parameter containing the path to a sensitive file (e.g., /etc/passwd or application configuration files).
4. The PeopleSoft PeopleTools application fails to validate the parameter, interpreting the input as a file system path.
5. The application processes the request and accesses the file on the server filesystem.
6. The server returns the contents of the requested file in the HTTP response body to the attacker.
7. Attacker parses the returned data to extract credentials, hashes, or configuration secrets to facilitate further system compromise.

Impact

Successful exploitation allows unauthenticated attackers to read any file on the server accessible by the service account. This frequently results in full system compromise via the acquisition of database and administrative credentials, potentially leading to unauthorized data exfiltration or lateral movement within the enterprise environment.

Recommendation

1. Patch Oracle PeopleSoft Enterprise PeopleTools by upgrading to a secured version as specified by Oracle security advisories for CVE-2023-22047.
2. Deploy the provided Sigma rule to monitor for suspicious GET requests containing path traversal sequences or sensitive file paths in the wsrp-url parameter.
3. Implement network-level access controls to restrict access to the /RP endpoint to only authorized internal IP ranges.
4. Review web server and application logs for anomalous requests to the /RP path containing the wsrp-url parameter.