My New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees Information's & In Some cases Passwords At More Than 1000 Companies
Hay Hunters , Hello Infosec Community
To Introduce My Self
My Name Orwa Atyat Iam Full Time Bug Bounty Hunter As You Know Me On Twitter (GodFather Orwa)
https://twitter.com/GodfatherOrwa
And Hunting On BugCrowd For Full Time With A Current Rank 66th And On P1 Bugs Current Rank 8th
https://bugcrowd.com/orwagodfather
https://hackerone.com/mr-hakhak
Our Topic Here Is About New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees Information’s [Emails , First & Last Name , User Name] & In Some cases Access To Data Base Passwords At More Than 1000 Companies That Used Oracle E-Business Login Panel Service
The Best Part Here It Is Not Common Vulnerability And Exposure (CVE) It Is New Vulnerability Due To This Security Issue, I Was Looking & Test It On Companies Deal With This Panel And It Work 100%
So You Can Check Your Private Programs , Or If You A Customers For Oracle Check Your Panels
As I Reported This And Fixed On About 15 Bounty Programs Like Uber, Amazon, Mastercard , Etc…..
In The Next Section Description & Steps To Reproduce
Description:
So I Discovery This Bugs On Oracle E-Business Login That When You Visit Its Like This
Target/OA_HTML/AppsLocalLogin.jsp
The Bug Here That I Can Create And Get Full Login And Access To This Panel
But When You Go To Register here Its Now Working As This Just For Employees
But You Can Register A Account On This End
Target/OA_HTML/ibeCAcpSSOReg.jsp
NOTE: Till Now This A Known Issue My Discovery After Create Account And Login
After I Found This Bug I Made Shodan Dork To Find All Oracle E-Business Login Panels
“X-ORACLE-DMS-ECID” http.title:”Login” 200
Steps To Reproduce For PII:
Visit The Target And Create Account
Target/OA_HTML/ibeCAcpSSOReg.jspAnd Back And Login With Your Credentials On
Target/OA_HTML/AppsLocalLogin.jsp
Move To Manage Proxies
Run Proxy Report
Get Access For All Employees Info
Emails &First name & Last Name & Username
Add For Employees That Start By a For Example In Search And Search
search for a or b or C Etc..
And You Can Search by Username Or First Or Last Name Or Email
And Will Got All Employees Result's 
There Is Definitely More But No Need To Dig Deeper
Steps To Reproduce For Passwords:
Note its not In all Panels Enabled
Back To home Page And Check On
Diagnostic Console If You Can Find It Then Ok With This One
Visit Diagnostic Console
Visit SQL===>
In SQL Statements===>select * from FND_USER===>RUN SQL
Then You Will Get Access For
USER_IDs,
USER_NAMEs,
LAST_UPDATE_DATE,
LAST_UPDATED_BY
CREATION_DATE,
CREATED_BY,
LAST_UPDATE_LOGIN,
ENCRYPTED_FOUNDATION_PASSWORDsAll Of This Findings Was With Hackerx007 As We Collaborate On All Hunt
I Hope you guys have enjoyed the Reading
and hope you learn and found bugs and tweet by that for me that will make my happy
Stay safe dears
Orwa
