Oracle HTTP Server 12.2.1.4.0 Third Party out-of-bounds write

Summaryinfo

A vulnerability, which was classified as very critical, was found in Oracle HTTP Server 12.2.1.4.0. Affected is an unknown function of the component Third Party. Such manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2023-38545. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Oracle HTTP Server 12.2.1.4.0 (Web Server). It has been rated as very critical. Affected by this issue is some unknown functionality of the component Third Party. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. The advisory is available at oracle.com. This vulnerability is handled as CVE-2023-38545. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 12/01/2025).

A public exploit has been developed in Bash and been published before and not just after the advisory. The exploit is available at github.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 92 days. During that time the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 210338 (Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)), which helps to determine the existence of the flaw in a target environment. The code used by the exploit is:

#!/bin/bash
printf "HTTP/1.1 301 Moved Permanently\nLocation: http:///$(printf 'A%.0s' {0..60000})/\nContent-Length: 0\nConnection: close\n\n" | nc -C -nvlp 8000 &
curl -L --limit-rate 32768 -x socks5h://localhost:10801 localhost:8000

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210338). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Server

Vendor

• Oracle

Name

• HTTP Server

Version

• 12.2.1.4.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion