1. Oracle E-Business Suite cybersecurity risks and mitigation
Eng. Matias Mevied
Oracle Security Specialist

2. ONAPSIS: COMPANY HIGHLIGHTS
Onapsis: Keeping Business-Critical Applications Secure & Compliant
Market Leaders
First-movers focused on Fortune and Federal organizations; over 200 customers
Thought Leaders
Dedicated in-house Research Labs; discovered over 500 vulnerabilities and attack vectors
Patented Technology Awarded patent covering underlying critical algorithms and capabilities
Experienced Management
Successful executives from IBM, RSA, EMC, Sophos, Amazon.com
Backed by Leading Investors
.406 Ventures, Schlumberger, Evolution, Arsenal, Endeavor
Board of Directors & Advisors
CISO Target, CISO Schlumberger, former AVG CEO, CTO Veracode
Sustained Hyper-Growth: 4th consecutive year of 100%+ YoY ARR & Bookings growth

3. Program Agenda Basic security configurations
Risk and mitigation examples
Advanced Security Configurations
Importance of implementing Critical Patch Updates
What does Onapsis do for EBS?

4. Basic security configurations

5. Basic Security configurations
There are different security features in Oracle E-Business Suite that an administrator has to be aware:
Password Policy
Hashed Passwords
Default passwords for application and database stacks (SYS.DBA_USERS_WITH_DEFPWD)
Unsuccessful login (FND_UNSUCCESSFUL_LOGINS)
SHA-1
SHA-2

6. Risk and mitigation examples

7. RISKS – Common vulnerabilities
There are different types of vulnerabilities which an attacker could use to attack E-Business Suite. For example:
Cross Site Scripting
Path Traversal
HTTP Vs HTTPs
SQL Injection
Report download without authentication

8. CROSS SITE SCRIPTING DEMO

9. Cross Site Scripting Mitigation
There exist different ways to mitigate the Cross Site Scripting attacks in Oracle E-Business Suite:
Oracle fixed this vulnerability in April CPU The solution was adding a new sanitization class called SecurityCrossScript to process the parameters. Our recommendation is always to apply the last Critical Patch Update.
Configure the FND_RESTRICT_INPUT profile which helps to sanitize the input
Implement Allowed JSP whitelist to reduce the attack surface
CVE reference: CVE CPU Reference: html
Doc ID: Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (April 2017)

10. RISKS – PATH traversal

11. PATH traversal Mitigation
Oracle fixes this vulnerability in July CPU 2016 changing the regex to restrict the accesses to operating system files. Our recommendation is always to apply the last Critical Patch Update.
The fix checks with a regex that the browser has in the URL only one (/) for each page.
CPU Reference: My Oracle Support -
Doc ID: Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (July 2016)

12. RISKS - HTTP
HTTP configuration is vulnerable to Man In The Middle attacks. The purpose of this attack is to sniff all the traffic from the browser to the server.
Attacker
Victim

13. HTTP DEMO

14. HTTPS
The following graph shows different types of traffic which could be encrypted with HTTPS in Oracle E-Business Suite.
Reference: My Oracle Support -
Doc ID: Enabling TLS in Oracle E-Business Suite Release 12.1.
Doc ID: Enabling TLS in Oracle E-Business Suite Release 12.2.

15. RISKS – SQL Injection
The following is the information which an attacker could see with this URL execution:

16. RISKS – SQL Injection
This is another example of how information an attacker could execute the SQL Injection:

17. SQL Injection - Mitigation
Oracle fixes this vulnerability with July CPU The solution for this fix is to request authentication before the user download some file and verify the permission to do that.
CVE reference: CVE­-2016-­3542
CPU Reference: My Oracle Support -
Doc ID: Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (July 2016)

18. RISKS – Report download
The following is the information which an attacker could download all the files from FND_LOBS with this URL execution

19. SQL Injection - Mitigation
Oracle fixes this vulnerability with July CPU 2017 for Weblogic. The solution for this fix is to request authentication before the user download some file and verify the permission to do that.
CVE reference: CVE
CPU Reference: My Oracle Support -
Doc ID: Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (July 2017)

20. Advanced Security Configurations

21. Advanced Configurations and new features for 12.2
Attack Surface - JSP Access
This feature is a whitelist of resources that are allowed to be called by your system.

22. Advanced Configurations and new features for 12.2
Attack Surface - Cookies Domain Scoping
This functionality check how the cookies scope is configured.

23. Importance of implementin g Critical Patch Updates

24. Stay current with patching
Oracle release every quarter the Critical Patch Update report with all the vulnerabilities and patches. In Oracle E-Business Suite product the patches are incremental. The patches are divided into two, one for 12.1 releases and the other for 12.2 releases.

25. Stay updated with patching
Onapsis helps with more than 200 vulnerabilities reported in Oracle E-Business Suite

26. Stay current with patching
Is it enough just to apply EBS and Database CPUs?
NO!
Based on the last CPUs for July 2018 in 12.2, is necessary review more …
Oracle Database or
Oracle Weblogic Server
Oracle Java (Including Java SE (JRE) Plug-in)
Oracle Access Manager

27. What does Onapsis do for EBS?

28. OSP DEMO

29. Thanks!!!
Questions?