A recent credential theft incident targeting an Oracle database server would not have been prevented by any of the 1,449 patches Oracle released in late July, according to cybersecurity firm Huntress. The attack highlights a shift in threat actor tactics toward exploiting system functionality rather than solely identifying vulnerabilities.
The incident began with a SQL injection against an unnamed organization's public-facing web application. While SQL injection is a well-known vulnerability, the subsequent actions taken by the threat actor were described as novel.
After gaining initial access, the attackers deployed a post-exploitation toolkit named "khunt." This toolkit was introduced into the Oracle database via a Java Source object, a technique rarely documented in real-world attacks. Oracle databases include an embedded Java Virtual Machine (JVM), allowing users to store Java source code as a database object.
In this specific attack, the threat actors utilized `CREATE JAVA SOURCE` commands. These commands were fed to the Oracle database from a Tomcat server through the existing database connection. The embedded Java source code was then compiled directly within the database as a stored schema object.
This method allowed the malicious toolkit to reside directly within the database engine. The technique, sometimes referred to as "oraexec," has been discussed conceptually in security circles for years, but its practical application in an actual attack has been infrequently observed.
A cybersecurity lead at Spinnaker Support, a third-party Oracle support vendor, confirmed that even a fully patched Oracle system would have been susceptible to this particular attack, emphasizing that the issue was not a missing patch but rather the exploitation of inherent system functionality.
The incident underscores a growing trend where attackers leverage legitimate features and operational mechanisms of software to achieve their objectives, rather than relying solely on traditional vulnerabilities that can be addressed through patching.
