CVE-2018-2879

Vulnerability

A cryptographic padding oracle vulnerability exists in Oracle Access Manager (OAM), a component of Oracle Fusion Middleware. The flaw resides in the authentication engine, which uses a block cipher mode that leaks padding validity information via response timing or error messages. Affected versions are 11.1.2.3.0 and 12.2.1.3.0 [1]. The vulnerability is triggered when an unauthenticated attacker sends specially crafted HTTP requests to an OAM endpoint, allowing them to decrypt and encrypt arbitrary session tokens [1][2].

Exploitation

An unauthenticated attacker with network access to an OAM instance can exploit this padding oracle without any prior authentication or user interaction. The attacker sends a series of requests to the OAM authentication endpoint, manipulating the ciphertext of a session cookie or URL parameter. By observing differences in error responses or timing, the attacker can recover the plaintext of existing tokens and, more critically, encrypt chosen plaintext values—such as a new token containing a target username [2]. Public exploit code is available [2], following the technical description by SEC Consult [1]. The required cryptographic oracle is accessed through standard HTTP requests, making remote exploitation straightforward.

Impact

Successful exploitation allows an attacker to fabricate a valid OAM session token for any arbitrary username. When a WebGate (the authentication component in front of a protected application) receives this forged cookie, it accepts it as legitimate authentication. The attacker gains immediate access to any web application protected by the affected OAM instance, impersonating a privileged user. This effectively bypasses the entire authentication mechanism, leading to a compromise of confidentiality, integrity, and availability (CVSS 9.0) [1]. The impact may extend to additional products relying on OAM for single sign-on, as noted in the CVE description.

Mitigation

Oracle has addressed this vulnerability in the Oracle Critical Patch Update for April 2018. The fix is described in My Oracle Support Note 2386496.1 [1]. The vendor provided a patch for both affected versions (11.1.2.3.0 and 12.2.1.3.0) [1]. Customers should apply the appropriate patch from Oracle immediately. No workaround is documented; upgrading to the patched version is the only recommended mitigation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog as of early 2024.