Oracle Hyperion Infrastructure Technology 11.2.14.0.000 Installation/Configuration request smuggling

Summaryinfo

A vulnerability, which was classified as very critical, was found in Oracle Hyperion Infrastructure Technology 11.2.14.0.000. Affected by this vulnerability is an unknown functionality of the component Installation/Configuration. The manipulation results in an unknown weakness. This vulnerability was named CVE-2023-25690. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as very critical has been found in Oracle Hyperion Infrastructure Technology 11.2.14.0.000. Affected is some unknown functionality of the component Installation/Configuration. CWE is classifying the issue as CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

The weakness was presented 10/17/2023 as Oracle Critical Patch Update Advisory - October 2023. The advisory is shared for download at oracle.com. This vulnerability is traded as CVE-2023-25690. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/04/2026).

As 0-day the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 211533 (Oracle Linux 9 : httpd (ELSA-2024-9306)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (211533) and CERT Bund (WID-SEC-2023-0583). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM Rational ClearQuest
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• IBM HTTP Server
• Oracle Linux
• IBM Security Access Manager for Enterprise Single Sign-On
• Red Hat JBoss Core Services
• Xerox FreeFlow Print Server
• IBM Business Automation Workflow
• IBM Rational ClearCase
• IBM QRadar SIEM
• IBM Power Hardware Management Console
• Apache HTTP Server
• Dell NetWorker
• IBM Rational Build Forge

Productinfo

Vendor

• Oracle

Name

• Hyperion Infrastructure Technology

Version

• 11.2.14.0.000

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion