Sigma rule: Potential CVE-2022-21587 Exploitation Attempt

Rule

Title

Potential CVE-2022-21587 Exploitation Attempt

Status

test

Level

high

Author

Isa Almannaei

Date

2023-02-13

File

rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

Log source

category

webserver

Detection

selection:
    cs-method: 'POST'
    cs-uri-query|contains:
        - '/OA_HTML/BneViewerXMLService?bne:uueupload=TRUE'
        - '/OA_HTML/BneUploaderService?bne:uueupload=TRUE'
        - '/OA_HTML/BneDownloadService?bne:uueupload=TRUE'
        - '/OA_HTML/BneOfflineLOVService?bne:uueupload=TRUE'
condition: selection

False positives (as the rule lists them)

• Vulnerability Scanners

Tags

• attack.initial-access
• attack.t1190
• cve.2022-21587
• detection.emerging-threats

CVEs this rule names

• CVE-2022-21587

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/
• https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis
• https://github.com/hieuminhnv/CVE-2022-21587-POC
• https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml