Rule Document 1:65455

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Oracle E-Business Suite vulnerable SyncServlet endpoint access attempt

Rule Explanation

This rule looks for inbound requests to the "/OA_HTML/SyncServlet" endpoint on Oracle E-Business Suite web applications. Attackers have been observed targeting this endpoint with an authentication bypass exploit to enable subsequent attacks that allow for remote code execution.

What To Look For

This rule fires on attempts to access the SyncServlet endpoint on Oracle E-Business Suite web applications, which is vulnerable to an authentication bypass vulnerability.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

This is an alert-only rule that detects all inbound requests sent to the "/OA_HTML/SyncServlet" endpoint. Network administrators should further investigate any events for suspicious activity. The presence of this event with other Oracle events is a potential indicator of malicious activity.

Contributors

Cisco Talos Intelligence Group