Top Highlights
- Attackers exploited a SQL injection vulnerability in a web app’s autocomplete feature to inject Java code into an Oracle database, enabling post-exploitation toolkit deployment.
- The toolkit used Java database objects to run OS commands, read user credentials, access files, and exfiltrate registry hives, rendering the database a pivot point for lateral movement.
- No patches address the underlying application flaw or privilege escalation, highlighting the need for input validation, parameterized queries, and minimum necessary permissions to prevent such breaches.
Threat Overview and Attack Techniques
Attackers exploited a vulnerability in an organization’s Oracle database. They used a flaw in a web application’s autocomplete search field. This flaw allowed them to send unvalidated input to the database through a JDBC connection. The account used had enough privileges to create Java objects in the database. The attackers uploaded Java source code to the database, which Oracle compiled into stored objects. They then ran commands from inside the database engine. This method turned the database into a platform for further attack. The attack chain was tracked by Huntress, which identified a toolkit called khunt. The toolkit included Java classes and PL/SQL wrappers for executing system commands and reading files. Some components of the toolkit could run Windows commands like cmd.exe, read user hashes, list files, and copy registry hives. The attack was successful because of inadequate input validation and excessive privilege rights for the database account.
Impact, Security Implications, and Remediation Guidance
This attack has serious consequences. It can give attackers SYSTEM-level access on Windows servers. This level of control allows them to steal data, install malware, or disrupt services. The main security concern is that the database, meant to store data, becomes a beachhead for deeper access into the organization. Preventing this attack involves fixing the application flaw by using parameterized queries and input validation. It is also important to follow the principle of least privilege. The account used by the application should not have permissions to create Java objects or run operating system commands. As Oracle does not provide a patch for the specific flaw, organizations should seek guidance from the relevant vendor or security authority. Regular monitoring of database logs and searching for unusual object names or activity can help detect intrusions.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
