Hello and welcome to the Tuesday, October 7th, 2025 edition of the Sands and at Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Denver, Colorado.

And this episode is brought you by the Sands.edu graduate certificate program in cybersecurity leadership.

Today, the big topic was still the patch being released by Oracle on Saturday for the Oracle E business suite.

I talked about it already yesterday.

Now there is no new update from Oracle about this,

so their advice still counts, apply the patch released on Saturday, in order to be protected

against this vulnerability. Now, after recording the podcast yesterday, I found a copy of the exploit script that was referenced

in Oracle's write-up. So this was basically the exploit script recovered from these

ransomer attacks. The exploit is quite complex. There's also a great and much more

detailed write-up by Watchtower explaining

what exactly is going on here. There are actually sort of a couple little exploits that are

being used in order to really make everything work. There's like a directory traversal in one

spot, for example, in order to make this exploit work without having to

authenticate first. But the critical part of the exploit is a server-side request forgery

issue using a somewhat interesting and, well, I think a little bit archaic in some ways,

technology XSLT.

This is essentially sort of style sheets for XML files.

And this has been used for server-side request forgery before.

The trick here is essentially that as part of an XML file,

you can reference an external file that will tell you how to render a

particular XML file, and that is sort of requesting that external file is triggering the server-side

...