.. / CVE-2018-3167

• SSRF
• Nuclei
• Web

Exploit for Oracle E-Business Suite - Blind SSRF (CVE-2018-3167)

Description:

Oracle E-Business Suite, Application Management Pack component (User Monitoring subcomponent), is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform post requests towards internal services which are not intended to be exposed. Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.

Nuclei Template

View the template here CVE-2018-3167.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-3167.yaml

References: