Oracle PeopleSoft SSRF can be chained to achieve remote code execution

The five-minute version

The researchers describe a Server-Side Request Forgery in the PeopleSoft Integration Gateway that lets an attacker send arbitrary HTTP requests to localhost, bypassing the validateClient check. They then show that the PeopleSoft Environment Management Hub allows arbitrary file writes and deserializes XML files without validation, enabling a web-shell write and XMLDecoder-based code execution. By chaining these primitives, the team demonstrates full remote code execution on affected PeopleSoft installations, and cites ongoing mass exploitation by the ShinyHunters group.

What they found 3

• PSIGW SSRF allows requests to localhost, bypassing validateClient protection.

  “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.”

• PSEMHUB external control of file path lets an attacker write a web shell to the WAR path, achieving immediate RCE.

  “By writing this shell to the PSEMHUB WAR path, the attacker achieves immediate remote code execution in the context of the PeopleSoft service account.”

• PSEMHUB deserializes untrusted XML files on startup, executing attacker-controlled payloads.

  “Java's XMLDecoder instantiates and configures the objects described in the XML during parsing, so the attacker's payload executes before the cast to Environment throws an exception.”

What’s new here 4

• Identification of three distinct PeopleSoft vulnerabilities (SSRF, file-path write, XML deserialization).
• Demonstration of how the SSRF bypasses localhost validation to reach privileged components.
• Evidence of active exploitation in the wild by the ShinyHunters group.
• Coordination with Oracle to assign separate CVEs for each issue.

Artifacts & methods 4

• PSIGW HttpListeningConnectorprimitive
• PSEMHUB ExecuteProcessActivityCommandprimitive
• XMLDecoderprimitive
• ShinyHunterssystem

Topics