Critical Oracle Solaris CVE-2024-21013 Flaw Lets Attackers Remotely Control Servers

Key Takeaways

• Attackers leveraged a common SQL injection vulnerability in a web application to compromise an Oracle database and subsequently a Windows Server.
• Instead of deploying traditional malware files, the threat actors concealed a remote-control toolkit, dubbed “khunt,” directly within the Oracle database’s embedded Java capabilities.
• This novel technique allowed the attackers to execute commands, steal credentials (including Windows registry hives), and achieve SYSTEM-level control over the Windows host, bypassing typical endpoint security measures.
• The incident underscores the critical importance of robust input validation for web applications and stringent permission management for database accounts, moving beyond sole reliance on patching.

Attackers Bypass Traditional Defenses by Hiding Toolkit in Oracle Database

A recent server compromise highlights a sophisticated attack vector where a seemingly common web application vulnerability facilitated a deep intrusion into a Windows Server. Threat actors exploited a SQL injection flaw to embed a remote-control toolkit directly within an Oracle database, enabling them to commandeer the underlying operating system and exfiltrate sensitive data.

This incident demonstrates how inadequate protections on a public-facing web form can serve as a critical pivot point, allowing attackers to transition from a web application to the backend operating system with significant privileges.

Exploiting SQL Injection for Initial Access

The attack originated by targeting a public-facing Java and Tomcat application, which was directly connected to an Oracle database. The attackers exploited an autocomplete search feature within the application that lacked proper input validation. By submitting carefully crafted database commands through this vulnerable feature, they were able to force the database to process arbitrary instructions, setting the stage for the subsequent phases of the intrusion.

Security researchers at Huntress detected this malicious activity when they observed suspicious attempts to steal credentials from a server hosting Oracle. Their subsequent investigation uncovered copies of critical Windows registry hives—specifically SAM, SECURITY, and SYSTEM. These files are invaluable to attackers as they can be used to recover password hashes offline, thereby expanding their access and control within the compromised network. As Huntress said in a report, a key aspect of this attack was that the malicious code was not initially written to disk as a conventional malware executable.

The “khunt” Toolkit: A Database-Resident Threat

Instead of relying on standard file-based malware, the attackers ingeniously utilized Oracle’s embedded Java capabilities to create and store Java source objects directly within the database. Commands transmitted via the application’s JDBC connection were compiled as stored schema objects. This method effectively transformed the Oracle database from a mere data repository into a covert launchpad for malicious operations, making it significantly harder for endpoint security solutions to detect.

The toolkit, which researchers named “khunt,” comprised several components designed for comprehensive server control. These included modules for executing Windows commands, harvesting Oracle usernames and passwords, navigating the file system, verifying the toolkit’s operational status, and unpacking additional files. This novel, database-resident approach allowed the attackers to explore and manipulate the server without leaving the obvious traces typically associated with malicious executables.

A critical phase of the attack involved one of the khunt components opening a command shell to identify the current user. This action confirmed that the attacker had successfully escalated privileges to SYSTEM-level, signifying a complete transition from database access to full operating system control. This scenario echoes the severity of threats like the Windows Netlogon RCE vulnerability, which also allows for remote operating system compromise in exposed server environments.

Following the privilege escalation, the attackers proceeded with credential collection. They employed standard Windows utilities to copy registry hives and enumerate running services, storing these extracted files within the Oracle directory. These files could then be exfiltrated for offline analysis, potentially revealing credentials for local accounts. This technique of registry hive credential theft is a common tactic to compromise local accounts.

It is crucial to note that the initial access was achieved through SQL injection, not a newly discovered software vulnerability. This distinction emphasizes the paramount importance of robust application design and stringent database permissions, rather than solely relying on patching efforts.

What You Should Do

• Review and Harden Web Applications: Conduct thorough security audits of all public-facing web forms and search fields that interact with databases. Pay particular attention to legacy features that may have been overlooked in previous testing cycles.
• Implement Strict Input Validation: Ensure all user-supplied input is rigorously sanitized and that database queries are parameterized. This prevents user input from being interpreted as executable SQL, a fundamental defense against injection attacks.
• Enforce Least Privilege for Database Accounts: Configure database accounts with the absolute minimum set of permissions required for their function. A web application’s database account, for instance, should never possess rights to create Java source objects, execute sensitive stored procedures, or gain broad operating system access. This limits the potential damage even if an injection vulnerability is exploited.
• Enhance Oracle Server Monitoring: Go beyond conventional file-based malware scans when monitoring Oracle servers. Actively search for unexpected Java classes within database objects, review PL/SQL wrappers for anomalies, and scrutinize web and SQL logs for unusual or unauthorized commands. These measures can uncover activity that traditional endpoint detection tools might miss.
• Apply Security Updates: Ensure all underlying Windows systems supporting Oracle workloads are kept up-to-date with the latest security patches, including June Microsoft security updates.
• Threat Hunt with IoCs: Leverage the provided Indicators of Compromise (IoCs) for proactive threat hunting. Prioritize investigations into unusual Oracle-created files, unexpected database objects, and any instances where oracle.exe has spawned command-line or registry manipulation tools.
• Incident Response: In the event of a suspected compromise, immediately isolate affected systems, reset

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackCVEHackerMalwarePatchSecurityThreat