# Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera

Oracle Opera FileReceiver servlet sanitizes encrypted jndiname/username before decrypting, letting unauthenticated attackers path-traverse and upload a CGI webshell for RCE.

- Payout: Research
- Severity: critical
- Program: Oracle Opera
- Credited: Assetnote
- Disclosed: 2024-01-03
- CVE: CVE-2023-21932
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/exploiting-an-order-of-operations-bug-to-achieve-rce-in-oracle-opera
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-an-order-of-operations-bug-to-achieve-rce-in-oracle-opera
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Java servlet file upload endpoint (FileReceiver) in operainternalservlets.war
**Root cause:** FileReceiver calls SanitizeParameters.sanitizeServletParamOrUrlString() on the jndiname and username parameters and then DES-decrypts them, so sanitization runs on ciphertext and the decrypted plaintext (including path traversal) is never sanitized.
**Steps:**
1. Obtain operainternalservlets.war from Oracle download center; find `/FileReceiver` mapping to com.micros.opera.servlet.FileReceiver.
2. Leak JNDI name unauthenticated via `/Operajserv/OXIServlets/CRSStatus?info=true` (also BEInterface, ExportReceiver).
3. Recreate Oracle's static-key DES routine; encrypt jndiname and username=`foo/../../../../../` to get `0c919bc95270f6921e102ab8ae52e497` and `f56ade9e2d01a95d782dc04e5fa4481309a563c219036e25`.
4. POST to `/Operajserv/webarchive/FileReceiver?filename=D:\MICROS\opera\operaias\cgi-bin\<hash>.cgi&crc=588&trace=ON&copytoexpdir=1&jndiname=...&username=...&append=1` with multipart body containing a Perl CGI webshell.
5. isAllowedPath canonicalizes `sourcePath + \ + schemaName` to `D:\`, so any D:\ filename passes the whitelist.
6. Access webshell at `/operabin/<hash>.cgi?type C:\Windows\win.ini` to execute commands.
**How found:** Source review of operainternalservlets.war; noticed sanitize-then-decrypt ordering on jndiname/username, then traced isFileInWhiteList/isAllowedPath and realized schemaName is concatenated into the canonicalized source path, enabling traversal to D:\ root.
**Exploitation:** Unauthenticated attacker leaks the JNDI name from info-enabled OXIServlets, encrypts a traversal username with the static DES key, and uploads a CGI Perl webshell into the opera cgi-bin directory via FileReceiver, then invokes it over HTTP to run arbitrary OS commands as the web server user.
**Insight:** When a parameter is encrypted, check whether sanitization runs before or after decryption—ciphertext passes filters trivially. Also audit whitelist checks that canonicalize `base + separator + userControlled` since traversal in the user segment collapses the base to a drive root.