Potential CVE-2022-21587 Arbitrary File Upload Attempts via Oracle EBS Web Services
Alerts on POST requests with uueupload=TRUE targeting specific Oracle EBS OA_HTML services associated with CVE-2022-21587.
- Category
- webserver
- Author
- Isa Almannaei (SigmaHQ), DRL 1.1
- Published
- 2023-02-13
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP POST requests whose URI query contains Oracle E-Business Suite (EBS) Bne* service endpoints with uueupload=TRUE. Such requests are consistent with attempted exploitation of CVE-2022-21587, an arbitrary file upload vulnerability that can enable unauthenticated remote code execution. It relies on webserver HTTP request telemetry capturing method and full query-string content, matching the specific OA_HTML/Bne* endpoints and parameter value.
Reporting behind it
- rapid7.comhttps://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/
- attackerkb.comhttps://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis
- github.comhttps://github.com/hieuminhnv/CVE-2022-21587-POC
- blog.viettelcybersecurity.comhttps://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential CVE-2022-21587 Arbitrary File Upload Attempts via Oracle EBS Web Services
id: d8e9cf84-4a9a-4fe3-b270-7f00c7fba9c2
status: test
description: This rule flags HTTP POST requests whose URI query contains Oracle E-Business Suite (EBS) Bne* service endpoints with uueupload=TRUE. Such requests are consistent with attempted exploitation of CVE-2022-21587, an arbitrary file upload vulnerability that can enable unauthenticated remote code execution. It relies on webserver HTTP request telemetry capturing method and full query-string content, matching the specific OA_HTML/Bne* endpoints and parameter value.
references:
- https://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/
- https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis
- https://github.com/hieuminhnv/CVE-2022-21587-POC
- https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml
author: Isa Almannaei, Huntrule Team
date: 2023-02-13
tags:
- attack.initial-access
- attack.t1190
- cve.2022-21587
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-query|contains:
- /OA_HTML/BneViewerXMLService?bne:uueupload=TRUE
- /OA_HTML/BneUploaderService?bne:uueupload=TRUE
- /OA_HTML/BneDownloadService?bne:uueupload=TRUE
- /OA_HTML/BneOfflineLOVService?bne:uueupload=TRUE
condition: selection
falsepositives:
- Vulnerability Scanners
level: high
license: DRL-1.1
related:
- id: d033cb8a-8669-4a8e-a974-48d4185a8503
type: derived