VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 17 hours ago

CVE-2012-3152

9.1 Critical Protected by RASP

Description

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

Exploitation Status

Exploited in the wild

Confirmed real-world exploitation.

CVSS E:A

  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 3 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2014-01-29.
  • EPSS 99% chance in 30 days A model prediction, not an observation. Higher than 99.9% of all scored CVEs.
IndexArtifactStarsFirst seen
GitHub PoC Automated exploitation scanner for Oracle Reports Server (rwservlet) — CVE-2012-3152 / CVE-2012-3153. Detects, fingerprints, reads files via LFI, tests SSRF via webhook, and uploads JSP shells. Targets Oracle Reports < 11g. For authorized use only. 6 2026-05-15
Exploit-DB Oracle Forms and Reports - Remote Code Execution (Metasploit) 2014-02-18
Exploit-DB Oracle Forms and Reports 11.1 - Arbitrary Code Execution 2014-01-29

Waratek Defense Posture

Protected by RASP

A Waratek agent blocks this today.

Applicable rule: CVE has an ARMR patch rule that provides mitigation

  • Protection full a patch rule written for this CVE
  • Action available patch rule
  • Review human armr-file
  • Record active
Decided by armr-patch-file : An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

Shipped files covering this CVE. A CVE genuinely takes more than one: separate Maven artifacts hooking different parser classes, the same patch built for two ARMR versions, or a fix at both the framework and the container.
rules/middleware/oracle/CVE-2012-3152/patch/2.6/CVE-2012-3152.armr patch rule added 2020-06-25 updated 2026-03-04 
app("CVE-2012-3152, CVE-2012-3153"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2012-3152, CVE-2012-3153

        CVSS 2.0 Summary:
            Base Score              | 6.4
            Attack Vector           | Network
            Attack Complexity       | Low
            Authentication          | None
            Confidentiality         | Partial
            Integrity               | Partial
            Availability Impact     | None

        Description:
            Unspecified vulnerability in the Oracle Reports Developer component
            in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows
            remote attackers to affect confidentiality and integrity via unknown
            vectors related to Report Server Component. NOTE: the previous
            information is from the October 2012 CPU. Oracle has not commented
            on claims from the original researcher that the URLPARAMETER
            functionality allows remote attackers to read and upload arbitrary
            files to reports/rwservlet, and that this issue occurs in earlier
            versions. NOTE: this can be leveraged with CVE-2012-3153 to execute
            arbitrary code by uploading a .jsp file.

        Resources:
            https://www.exploit-db.com/exploits/31253/
            http://www.primalsecurity.net/python-tutorials-use-case-cve-2012-3152/
            https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_reports_rce.rb

        Affected Operating System:
            Any

        Affected Versions:
            Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0

        Tested Versions:
            Oracle Application Server (OC4J) with Oracle 12c (WebLogic 12.2.1.2)

        Protection Provided:
            Virtual patch based on public exploits.

        Patch Version:
            1.2-b07
        Supported app servers:
            WebLogic, OC4J.
    ***************************************************************************/

    #
    # LFI Patch for OC4J
    #

    patch("CVE-2012-3152, CVE-2012-3153 :01"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getQueryString()Ljava/lang/String;")
        exit()

        code(language: java,   import: ["java.net.URI",
                                        "javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String URLPARAMETER = "urlparameter";
            private static final String[] SAFE_PROTOCOLS = {
                    "http://", "https://", "\"http://", "\"https://",
                    "%22http://", "%22https://", "%27http://", "%27https://",
                    "http%3A%2F%2F", "https%3A%2F%2F", "\"http%3A%2F%2F", "\"https%3A%2F%2F",
                    "%22http%3A%2F%2F", "%22https%3A%2F%2F", "%27http%3A%2F%2F", "%27https%3A%2F%2F"
            };
            private static final String[] SAFE_HOSTS = {""};
            private static final String SAFE_QUERY_STRING = "";

            public void patch(JavaFrame frame) {

                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String query = frame.loadStringOperand(0);

                if (query == null) {
                    return;
                }

                try {
                    query = java.net.URLDecoder.decode(query, "UTF-8").toLowerCase();
                } catch (java.io.UnsupportedEncodingException ex) {
                    // ignore, UTF-8 is hardcoded
                }

                if (query.indexOf(URLPARAMETER) > -1) {
                    String[] keyValues = query.split(" ");
                    blockIfMalicious(keyValues, frame, uri);
                    keyValues = query.split("&");
                    blockIfMalicious(keyValues, frame, uri);
                }
            }

            private void blockIfMalicious(String[] keyValues, JavaFrame frame, String uri) {
                if (keyValues == null) {
                    return;
                }

                for (String keyVal : keyValues) {
                    String[] pair = keyVal.split("=", 2);
                    if (pair.length != 2) {
                        continue;
                    }

                    String key = pair[0];
                    String val = pair[1];

                    if (URLPARAMETER.equalsIgnoreCase(key)) {
                        for (String safeProtocol : SAFE_PROTOCOLS) {
                            if (val.startsWith(safeProtocol) && isSafeHost(val)) {
                                return;
                            }
                        }
                        logAttack(uri, keyVal);
                        frame.returnString(SAFE_QUERY_STRING);
                        return;
                    }
                }
            }

            private boolean isSafeHost(String val) {
                try {
                    val = trimCharacter(val, '"');
                    val = trimCharacter(val, '\'');
                    URI uri = new URI(val);
                    String host = uri.getHost();

                    if (host == null
                        || host.equalsIgnoreCase("localhost")
                        || host.equalsIgnoreCase("127.0.0.1")) {
                        return true;
                    }

                    host = host.toLowerCase();
                    for (String safeHost : SAFE_HOSTS) {
                        if (safeHost.toLowerCase().equals(host)) {
                            return true;
                        }
                    }
                    return false;
                } catch (Throwable t) {
                    return true;
                }
            }

            public static String trimCharacter(String string, char c) {
                if (string == null || string.length() == 0) {
                    return string;
                }
                int start = 0;
                int last = string.length();
                while (start < last) {
                    if (string.charAt(start) == c) {
                        start++;
                    } else if (string.charAt(last - 1) == c) {
                        last--;
                    } else {
                        break;
                    }
                }
                return string.substring(start, last);
            }

            private void logAttack(String uri, String query) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to query the file-system, related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("query", String.valueOf(query));
                event.addExtension("act", "protect");
                event.commit();
            }
        endcode
    endpatch

    #
    # RCE Patch for OC4J
    #

    patch("CVE-2012-3152, CVE-2012-3153 :02"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getParameter(Ljava/lang/String;)Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String param = frame.loadStringVariable(1);
                if (param == null || !param.equalsIgnoreCase(VULNERABLE_PARAM)) {
                    return;
                }

                String paramValue = frame.loadStringOperand(0);
                if (paramValue == null) {
                    return;
                }

                paramValue = paramValue.toLowerCase();
                for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                    if (paramValue.endsWith(extension)) {
                        block(frame, uri, paramValue);
                        return;
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnString(SAFE_PARAMETER_VALUE);
            }
        endcode
    endpatch

    patch("CVE-2012-3152, CVE-2012-3153 :03"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getParameterValues(Ljava/lang/String;)[Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";
            private static final String[] SAFE_PARAMETER_VALUES = {""};

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String param = frame.loadStringVariable(1);
                if (param == null || !param.equalsIgnoreCase(VULNERABLE_PARAM)) {
                    return;
                }

                String[] paramValues = (String[]) frame.loadObjectOperand(0);
                if (paramValues.length == 0) {
                    return;
                }

                for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                    for (String paramValue : paramValues) {
                        if (paramValue != null && paramValue.toLowerCase().endsWith(extension)) {
                            block(frame, uri, paramValue);
                            return;
                        }
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnObject(SAFE_PARAMETER_VALUES);
            }
        endcode
    endpatch

    patch("CVE-2012-3152, CVE-2012-3153 :04"):
        function("com/evermind/server/http/EvermindHttpServletRequest.getQueryString()Ljava/lang/String;")
        exit()

        code(language: java,   import: ["javax.servlet.http.HttpServletRequest",
                                        "javax.servlet.ServletRequest",
                                        "com.evermind.net.AddressContainer",
                                        "com.evermind.server.http.EvermindHttpServletRequest"]):

            private static final String VULNERABLE_PARAM = "desname";
            private static final String VULNERABLE_URI = "/reports/rwservlet";
            private static final String[] MALICIOUS_FILE_EXTENSIONS = {".jsp", ".bat", ".sh", ".exe", ".class", ".java", ".so", ".dll"};
            private static final String SAFE_PARAMETER_VALUE = "";
            private static final String SAFE_QUERY_STRING = "";

            public void patch(JavaFrame frame) {
                EvermindHttpServletRequest self = (EvermindHttpServletRequest) frame.loadThisVariable();
                String uri = self.getRequestURI();
                // String.contains() does not exist in Java 1.4
                if (uri == null || uri.toLowerCase().indexOf(VULNERABLE_URI) == -1) {
                    return;
                }

                String query = frame.loadStringOperand(0);
                if (query != null && query.toLowerCase().indexOf(VULNERABLE_PARAM) > -1) {
                    String[] keyValues = query.split("\\+");
                    blockIfMalicious(keyValues, frame, uri);
                    keyValues = query.split("&");
                    blockIfMalicious(keyValues, frame, uri);
                }
            }

            private void blockIfMalicious(String[] keyValues, JavaFrame frame, String uri) {
                if (keyValues == null) {
                    return;
                }

                for (String keyVal : keyValues) {
                    String[] pair = keyVal.split("=");
                    if (pair.length != 2) {
                        continue;
                    }

                    String key = pair[0];
                    String val = pair[1];

                    val = val.toLowerCase();
                    if (VULNERABLE_PARAM.equalsIgnoreCase(key)) {
                        for (String extension : MALICIOUS_FILE_EXTENSIONS) {
                            if (val != null && val.endsWith(extension)) {
                                block(frame, uri, val);
                                return;
                            }
                        }
                    }
                }
            }

            private void block(JavaFrame frame, String uri, String paramValue) {
                ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
                event.addExtension("msg", "An attempt was made to upload a file related to CVE-2012-3152.");
                event.addExtension("servletUri", String.valueOf(uri));
                event.addExtension("paramValue", String.valueOf(paramValue));
                event.addExtension("act", "protect");
                event.commit();
                frame.returnObject(SAFE_QUERY_STRING);
            }
        endcode
    endpatch

endapp

#
# Process forking control for RCE mitigation.
#

app("PROCESS CONTROL"):
    requires(version: "ARMR/1.3")

    ############################################################################
    # Process Control
    #
    # Description:
    #   Executing commands or loading libraries from an untrusted source or in
    #   an untrusted environment can cause an application to execute malicious
    #   commands (and payloads) on behalf of an attacker.
    #       * ProcessBuilder.start() - prevent this method from forking processes.
    #       * Runtime.exec() - prevent all overloaded variants from forking processes.
    #
    # Labels:
    #   CWE-114
    #
    # Mitigation/Remediation Control:
    #   Restrict which executables are allowed to be forked by the JVM by
    #   whitelisting blacklisting the executable name or the full command
    #   line (executable + arguments). The '*' character is treated as a
    #   wildcard and can be used to blacklist/whitelist all executables.
    #   Blacklists and Whitelists can be used at the same time.
    #   Whitelists have precedence.
    ############################################################################

    patch("Process Forking :01"):
       function("java/lang/ProcessBuilder.start()Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException", "java.util.List"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//          private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              ProcessBuilder self = (ProcessBuilder) frame.loadThisVariable();
              List<String> commands = (List<String>) self.command();

              if (commands != null && !commands.isEmpty()) {
                  String command = commands.get(0);
                  if (command == null) {
                      return;
                  }

                  String commandWithArguments = stringJoin(" ", commands);
                  securityCheck(frame, command.trim(), commandWithArguments.trim());
              }
          }

          public static String stringJoin(String separator, List<String> list) {
              if (list == null || list.size() == 0) {
                  return "";
              }
              if (list.size() == 1) {
                  return list.get(0) != null ? list.get(0) : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(list.get(0));
              for (int i = 1; i < list.size(); i++) {
                  sb.append(separator).append(list.get(i));
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.ProcessBuilder.start()");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.ProcessBuilder.start()");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :02"):
       function("java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException", "java.util.StringTokenizer"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//          private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String commandWithArguments = (String) frame.loadObjectVariable(1);
              if (commandWithArguments != null) {
                  securityCheck(frame, getExecutable(commandWithArguments), commandWithArguments.trim());
              }
          }

          private static String getExecutable(String command) {
               return command.split(" ")[0].trim();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :03"):
       function("java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }

              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :04"):
       function("java/lang/Runtime.exec([Ljava/lang/String;[Ljava/lang/String;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }

              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[])");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

    patch("Process Forking :05"):
       function("java/lang/Runtime.exec([Ljava/lang/String;[Ljava/lang/String;Ljava/io/File;)Ljava/lang/Process;")
       entry()

       code(language: java,   import: ["java.io.IOException"]):
          private static final String[] BLACKLIST = {"*"}; // block and log all executables (except if any have been whitelisted)
//          private static final String[] BLACKLIST = {"cmd", "cmd.exe", "C:\\Windows\\System32\\cmd",
//                 "C:\\Windows\\System32\\cmd.exe", "powershell", "ifconfig"};
          private static final String[] WHITELIST = {""};
//           private static final String[] WHITELIST = {"*"}; // allow and log all executables

          public void patch(JavaFrame frame) {
              String[] commands = (String[]) frame.loadObjectVariable(1);

              if (commands == null || commands[0] == null) {
                  return;
              }
              String commandWithArguments = stringJoin(" ", commands);
              securityCheck(frame, commands[0].trim(), commandWithArguments.trim());
          }

          public static String stringJoin(String separator, String[] arr) {
              if (arr == null || arr.length == 0) {
                  return "";
              }
              if (arr.length == 1) {
                  return arr[0] != null ? arr[0] : "";
              }
              StringBuffer sb = new StringBuffer(256);
              sb.append(arr[0]);
              for (int i = 1; i < arr.length; i++) {
                  sb.append(separator).append(arr[i]);
              }
              return sb.toString();
          }

          private static void block(JavaFrame frame, String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "high");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[], java.io.File)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "protect");
              event.commit();
              frame.raiseException(new IOException("Operation not allowed"));
          }

          private static void allow(String commandWithArguments) {
              ArmrEvent event = ArmrEvent.load("Execute Rule", "low");
              event.addExtension("commandLine", String.valueOf(commandWithArguments));
              event.addExtension("method", "java.lang.Runtime(java.lang.String[], java.lang.String[], java.io.File)");
              event.addExtension("msg", "forked OS process");
              event.addExtension("act", "allow");
              event.commit();
          }

          private static void securityCheck(JavaFrame frame, String command, String commandWithArguments) {
              for (String exec : WHITELIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      allow(commandWithArguments);
                      // process is whitelisted, so it has a free pass. No need to do any more blockIfMaliciouss.
                      return;
                  }
              }
              for (String exec : BLACKLIST) {
                  if (exec.equals("*") || command.equalsIgnoreCase(exec)
                          || commandWithArguments.equalsIgnoreCase(exec)) {
                      block(frame, commandWithArguments);
                  }
              }
          }
       endcode
    endpatch

endapp

CVSS

9.1 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CISA-ADP Secondary
CVSS 2.0 6.4 no band published AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2012 ↗ CPU 2012-Q4 Oracle Fusion Middleware / Report Server Component (11.1.1.4, 11.1.1.6, 11.1.2.0)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Fusion Middleware Report Server Component 11.1.1.4, 11.1.1.6, 11.1.2.0 11.1.1.4 · 11.1.1.6 · 11.1.2.0

🖥️ Product CPEs & Version Ranges

1 product(s) over 3 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd oracle fusion middleware generic 11.1.1.4.0 · 11.1.1.6.0 · 11.1.2.0

References

URLTags
http://blog.netinfiltration.com/2013/11/03/oracle-reports-cve-2012-3152-and-cve-2012-3153/ Broken Link
http://blog.netinfiltration.com/2014/01/19/upcoming-exploit-release-oracle-forms-and-reports-11g/ Broken Link
http://seclists.org/fulldisclosure/2014/Jan/186 Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/31253 Exploit, Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Patch, Vendor Advisory
http://www.osvdb.org/86394 Broken Link
http://www.osvdb.org/86395 Broken Link
http://www.securityfocus.com/bid/55955 Broken Link, Third Party Advisory, VDB Entry
http://www.youtube.com/watch?v=NinvMDOj7sM Exploit

Timeline

Published 2012-10-16 Last modified 2026-06-16
Published2012-10-16By the CVE Program.
ARMR remediation created2020-06-25Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-16NVD's own last-modified date for this record.