How to remediate – Oracle 9iAS XSQLServlet soapConfig.xml Authentication Credenti…

1. Introduction

The Oracle 9iAS XSQLServlet soapConfig.xml Authentication Credentials vulnerability allows unauthenticated access to configuration files on a default installation. This can expose sensitive information about the system, including database usernames and passwords, potentially leading to compromise of data confidentiality, integrity, and availability. Systems running Oracle 9iAS version 1.0.2.2.1 are typically affected. Impact is likely to be high if credentials exposed allow access to critical databases.

2. Technical Explanation

The vulnerability occurs because the XSQLServlet in a default configuration allows retrieval of sensitive files, specifically soapConfig.xml. This file contains installation details and potentially database access credentials. An attacker can directly request this file via HTTP, bypassing intended security controls. The Common Vulnerabilities and Exposures (CVE) identifier for this issue is CVE-2002-0568.

• Root cause: Default configuration allows unauthenticated access to sensitive files.
• Exploit mechanism: An attacker sends an HTTP request to retrieve the soapConfig.xml file. For example, http://target_host/xsqlservlet/soapConfig.xml.
• Scope: Oracle 9iAS version 1.0.2.2.1 is affected.

3. Detection and Assessment

You can confirm vulnerability by attempting to retrieve the soapConfig.xml file directly. A thorough assessment involves reviewing filesystem permissions on the XSQLServlet directory.

• Quick checks: Use curl or a web browser to access http://target_host/xsqlservlet/soapConfig.xml. If the file is displayed, the system is vulnerable.
• Scanning: Nessus plugin ID 30689 may detect this vulnerability as an example only.
• Logs and evidence: Check web server logs for requests to /xsqlservlet/soapConfig.xml.

curl http://target_host/xsqlservlet/soapConfig.xml

4. Solution / Remediation Steps

To fix this issue, restrict access to the soapConfig.xml file by modifying its permissions. Be aware that the XSQLServlet may bypass filesystem restrictions.

4.1 Preparation

• Ensure you have access to modify file permissions on the server. A roll back plan involves restoring the backed-up files and restarting the service.
• A change window may be required depending on your organisation’s policies, with approval from the system owner.

4.2 Implementation

1. Step 1: Change the permissions of soapConfig.xml to restrict access to only the web server process user. For example, using chmod 600 soapConfig.xml.
2. Step 2: Verify that other users cannot read the file.

4.3 Config or Code Example

Before

ls -l soapConfig.xml
-rw-r--r-- 1 owner group size date soapConfig.xml

After

ls -l soapConfig.xml
-rw------- 1 owner group size date soapConfig.xml

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege reduces the impact if a vulnerability is exploited, and secure defaults minimise initial exposure.

• Practice 1: Implement least privilege principles for all system accounts and processes.
• Practice 2: Enforce safe default configurations on all software installations.

4.5 Automation (Optional)

#!/bin/bash
# Script to change permissions on soapConfig.xml
FILE="/path/to/soapConfig.xml"
chmod 600 "$FILE"
echo "Permissions changed for $FILE"

5. Verification / Validation

• Post-fix check: Use curl http://target_host/xsqlservlet/soapConfig.xml. You should receive an error message (e.g., 403 Forbidden).
• Re-test: Repeat the quick check from Section 3. The file should no longer be accessible.
• Monitoring: Monitor web server logs for failed requests to /xsqlservlet/soapConfig.xml as an example alert.

curl http://target_host/xsqlservlet/soapConfig.xml
403 Forbidden

6. Preventive Measures and Monitoring

Update security baselines to include file permission requirements for web server configuration files. Consider adding checks in your CI pipeline to enforce these settings.

• Baselines: Update a security baseline or policy with required file permissions for sensitive files like soapConfig.xml.
• Pipelines: Add static analysis checks to deployment pipelines to identify insecure default configurations.
• Asset and patch process: Review and apply security patches regularly, ideally within 30 days of release.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Incorrect permissions may prevent the web server from accessing necessary files, causing service disruption.
• Roll back: Restore the backed-up soapConfig.xml file and restart the Oracle 9iAS instance.

8. References and Resources

• Vendor advisory or bulletin: http://www.nextgenss.com/papers/hpoas.pdf
• NVD or CVE entry: CVE-2002-0568
• Product or platform documentation relevant to the fix: https://www.oracle.com/technetwork/index.html