Oracle Database Attack: Even All Patches Applied Couldn't Prevent It
Security experts analyzed the attack using SQL injection and Java source code.
1Oracle's Massive Patches Were Insufficient
Oracle released 1,449 security patches in July 2023. However, these patches failed to prevent an Oracle database attack reported by Huntress. The attack began with an SQL injection on a web application and involved uploading Java source code to the database. This highlighted the inadequacy of Oracle's security measures.
2Attack Started with SQL Injection
The attack began with a simple SQL injection targeting an unknown organization's web application. While SQL injections have a long history, what followed was more unusual. The attackers gained initial access and then uploaded Java source code to the Oracle database.
3Access to Database via Java Source Code
The attackers uploaded Java source code to the Oracle database, deploying a post-exploitation toolkit called khunt. This exploited Oracle's ability to compile Java code directly within its database engine. This technique, previously known as oraexec, had rarely been documented.
4Oracle's Use of Java Virtual Machine (JVM)
Oracle's database includes an embedded Java Virtual Machine (JVM), allowing users to store Java source code as a database object. The attackers leveraged this feature to upload and compile Java source code directly within the database.
5Warning from Spinnaker Support
Craig Savage, cybersecurity lead at Spinnaker Support, emphasized that the ability to compile Java code in Oracle databases should be restricted. Savage argued that this capability should be limited to DBA users and disabled on production servers.
6Cybercriminals' New Tactics
Savage noted that cybercriminals are increasingly focusing on exploiting legitimate product functionalities rather than just vulnerabilities. In this attack, the attackers used Oracle's Java compilation feature, underscoring the need for organizations to review basic security measures.
7Shortcomings in Oracle's Security Measures
Oracle released around 1,450 security patches in July. However, Savage stressed that organizations must not neglect basic security measures while focusing on patches. This attack exposed deficiencies in Oracle's security configuration.
8A Wake-Up Call for the Industry
This attack serves as a wake-up call for the cybersecurity industry. Organizations must focus not only on patches but also on basic security measures. The misuse of legitimate functionalities, such as Oracle's Java compilation feature, sets a precedent for future attacks.