Detect two Oracle E-Business Suite exposures, and let a rule try several known paths

Two curated detection rules for Oracle E-Business Suite, both read only, both
firing only on proof against a control.

The first is the self-registration exposure behind CVE-2022-21500: the iStore
registration pages answering an unauthenticated visitor, which lets an outsider
register an account over HTTP.  It checks the four known registration paths and
confirms the real registration page, not a soft 404, by the exact text the page
carries.  Oracle says 12.2 is affected and 12.1 is not, and the fix is in the
remediation.

The second is the jtfwrepo.xml repository file served to anyone, with the xml
content type and a body carrying a password field or a user list: an internal
configuration file that can disclose credentials and should never be reachable
from outside.

To support the first, a rule can now carry candidate_paths, a short list of
known paths to try, firing on the first that confirms.  It reuses the existing
route machinery, so the engine, the scope gate and the safety contract are
unchanged; a rule with no such list behaves exactly as before.

Author: hackrange

app/core/dast_checks/curated/access-control-oracle-ebs-self-registration-cve-2022-21500.json

@@ -0,0 +1,40 @@
+{
+  "id": "access-control-oracle-ebs-self-registration-cve-2022-21500",
+  "class": "access-control",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Oracle E-Business Suite self-registration is open (CVE-2022-21500)",
+  "summary": "The iStore self-registration pages answer an unauthenticated visitor, the exposure behind CVE-2022-21500 in the Manage Proxies component. An outsider can register an account over HTTP and reach functions that should be behind a login. Oracle says 12.2 is affected and 12.1 is not.",
+  "needs": [],
+  "candidate_paths": [
+    "/OA_HTML/ibeCAcpSSOReg.jsp",
+    "/OA_HTML/ibeCRgpPrimaryCreate.jsp",
+    "/OA_HTML/ibeCRgpIndividualUser.jsp",
+    "/OA_HTML/ibeCRgpPartnerPriCreate.jsp"
+  ],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "{route}"
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and the registration page is told apart from a soft 404.",
+    "differential": "status == 200 and body_contains(\"Register as individual\") and body_contains(\"Registration\") and body_contains(\"ibeCZzpRuntimeIncl.jsp\") and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/OA_HTML/ibeCAcpSSOReg.jsp' and look for the registration form: it returns HTTP 200 with 'Register as individual' and the page include 'ibeCZzpRuntimeIncl.jsp', so an unauthenticated visitor can self-register. Try the other paths too: /OA_HTML/ibeCRgpPrimaryCreate.jsp, /OA_HTML/ibeCRgpIndividualUser.jsp, /OA_HTML/ibeCRgpPartnerPriCreate.jsp.",
+  "remediate": "Apply Oracle's CVE-2022-21500 fix. If iStore self-registration is not used, disable ibeCAcpSSOReg.jsp and remove the self-registration link from AppsLocalLogin.jsp, and deny the registration paths with the Allowed Resources framework. Oracle E-Business Suite 12.1 is not affected.",
+  "references": [
+    "https://www.oracle.com/security-alerts/alert-cve-2022-21500.html"
+  ],
+  "mappings": {
+    "cwe": "CWE-284",
+    "owasp": "A01:2021"
+  },
+  "rulesets": [
+    "oracle-ebs"
+  ]
+}

app/core/dast_checks/curated/misconfiguration-oracle-ebs-credentials-jtfwrepo.json

@@ -0,0 +1,32 @@
+{
+  "id": "misconfiguration-oracle-ebs-credentials-jtfwrepo",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Oracle E-Business Suite exposes jtfwrepo.xml",
+  "summary": "The repository file /OA_HTML/jtfwrepo.xml is served to anyone, with the text/xml content type and a body carrying a password field or a user list. It is an internal configuration file that can disclose credentials, and it should never be reachable from outside.",
+  "needs": [],
+  "probe": [
+    {
+      "request": {
+        "method": "GET",
+        "path": "/OA_HTML/jtfwrepo.xml"
+      }
+    }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and the exposed file is told apart from a soft 404.",
+    "differential": "status == 200 and \"text/xml\" in header(\"content-type\") and (body_contains(\"password=\") or body_contains(\"<PUSR_LIST>\")) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/OA_HTML/jtfwrepo.xml' and check it returns HTTP 200 with a text/xml body that contains 'password=' or '<PUSR_LIST>'. That file is internal configuration and should not be reachable without authentication.",
+  "remediate": "Block /OA_HTML/jtfwrepo.xml at the web tier and with the Oracle E-Business Suite Allowed Resources (URL Firewall) framework, so the repository file is not served to unauthenticated clients. Rotate any credential the file disclosed.",
+  "references": [],
+  "mappings": {
+    "cwe": "CWE-200",
+    "owasp": "A05:2021"
+  },
+  "rulesets": [
+    "oracle-ebs"
+  ]
+}

app/core/dast_checks/engine.py

@@ -355,9 +355,13 @@ def run_rule(spec: dict, ctx: dict) -> dict:
                     allow_private=bool(ctx.get("allow_private")),
                     headers=ctx.get("headers"))
 
-    # A rule with {route} in its probe is aimed at the discovered routes; a
-    # fixed-path rule is run once, not repeated against every route.
-    if _uses_route(spec):
+    # A rule with {route} in its probe is aimed somewhere: at a fixed list the
+    # rule itself carries (candidate_paths, for a check with several known paths
+    # to try, firing on the first that confirms), or at the discovered routes.
+    # A rule with no {route} is run once against its fixed path.
+    if _uses_route(spec) and spec.get("candidate_paths"):
+        routes = [str(p) for p in spec["candidate_paths"]][:MAX_ROUTES]
+    elif _uses_route(spec):
         routes = list(ctx.get("code_routes") or [])[:MAX_ROUTES]
     else:
         routes = [""]