Webserver: Detect POST attempts to Oracle E-Business Suite uueupload endpoints (CVE-2022-21587)

title: "Webserver: Detect POST attempts to Oracle E-Business Suite uueupload endpoints (CVE-2022-21587)"
id: d8e9cf84-4a9a-4fe3-b270-7f00c7fba9c2
status: test
description: This rule flags webserver requests that use HTTP POST with query parameters indicating uueupload=TRUE against specific Oracle E-Business Suite OA_HTML service endpoints. These patterns match behaviors associated with potential exploitation of CVE-2022-21587, which is described as an arbitrary file upload leading to unauthenticated remote code execution. Telemetry required includes webserver request method and full URI query strings to evaluate the exact endpoint paths and parameters.
references:
  - https://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/
  - https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis
  - https://github.com/hieuminhnv/CVE-2022-21587-POC
  - https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml
author: Isa Almannaei, Huntrule Team
date: 2023-02-13
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-21587
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE
      - /OA_HTML/BneUploaderService?bne:uueupload=TRUE
      - /OA_HTML/BneDownloadService?bne:uueupload=TRUE
      - /OA_HTML/BneOfflineLOVService?bne:uueupload=TRUE
  condition: selection
falsepositives:
  - Vulnerability Scanners
level: high
license: DRL-1.1
related:
  - id: d033cb8a-8669-4a8e-a974-48d4185a8503
    type: derived