Oracle-BI (CVE-2020-2950)
AMF deseiralize
Version: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0
Install:https://www.sql.edu.vn/obiee/oracle-business-intelligence-12c/
Ref: https://peterjson.medium.com/cve-2020-2950-turning-amf-deserialize-bug-to-java-deserialize-bug-2984a8542b6f
Exploit - PoC
amf.bin
Header cmd with base64 and child !!
![](https://github.com/tuo4n8/CVE-2020-2950/raw/main/README.assets/rce.jpg)
Debug trace bug
URL: /analytics/jbips/messagebroker/cs/
- Handle request -> processCall()
![image-20210521104317854](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104317854.png)
- Get inputstream -> deserialize AMF package
![image-20210521104423834](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104423834.png)
- Get Object AMF -> deserilize
![image-20210521104538758](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104538758.png)
![image-20210521104730919](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104730919.png)
![image-20210521104755256](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104755256.png)
![image-20210521104844150](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104844150.png)
- If matching type -> AMF readobject (AMF3DATA.class)
![image-20210521104956342](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521104956342.png)
- AMF3DATA.class -> AMF3ObjectInput
- In AMF3ObjectInut -> readComplexObject
![image-20210521105409912](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521105409912.png)
- In readComplexObject:
- If class deseriliaze is externalizable -> radExternalchain
- else setFiled
![image-20210521105523270](https://github.com/tuo4n8/CVE-2020-2950/raw/main/take-note.assets/image-20210521105523270.png)
- AMF deserialize chain -> readExternal Chain