A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
It may allow an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager and use it to create users with any privileges or to execute arbitrary code on the victim’s server, Jang explained earlier this year.
The vulnerability affected v18.104.22.168.0, 22.214.171.124.0 and 126.96.36.199.0 of Oracle Access Manager and has been patched in those supported versions, but according to Jang, it also affects Oracle Weblogic Server 11g (10.3.6.0) and OAM 11g (188.8.131.52.0), which stopped being supported on January 1, 2022, and therefore don’t have a patch available for this RCE.
Several proof-of-concept exploits for CVE-2021-35587 have been published on GitHub after Jang and Peterjson released part of theirs in March 2022, but according to CISA, successful exploitation attempts have now been detected. Unfortunately, the agency has not provided any insight into these attack(s).
The fact that this vulnerability has made it into the KEV catalog means that US Federal Civilian Executive Branch agencies are required to implement the patches by December 19, 2022, but CISA “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”