# [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Oracle Access Manager on a DoD host was vulnerable to a padding oracle in the encquery parameter, allowing decryption of encrypted messages and potential auth bypass.

- Payout: hidden
- Severity: high
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2021-07-29
- CVE: CVE-2018-2879
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/728110
- Library page: https://bugbountylibrary.com/r/h1%3A728110
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:java vuln:auth-bypass vuln:crypto

**Target:** Oracle Access Manager web endpoint (encquery parameter)
**Root cause:** OAM's CBC-mode encryption of encquery/encreply/OAMAuthnCookie lacks integrity protection, exposing a padding oracle via distinguishable error responses.
**Steps:**
1. Identify OAM instance at target URL
2. Modify OAMBuster PoC to add `gcds-consent=true` to all requests to bypass consent banner
3. Run `oambuster.py -d https://target` to probe padding oracle
4. Observe distinguishable responses to recover plaintext byte-by-byte from `encquery`
**How found:** Recognized the target as Oracle Access Manager, matched it to known CVE-2018-2879, and adapted the public OAMBuster tool (adding gcds-consent=true) to confirm the oracle.
**Exploitation:** Attacker sends crafted ciphertexts to the encquery parameter and uses the padding oracle to decrypt messages; since encquery, encreply and OAMAuthnCookie share a key, decrypted/forged cookies could enable authentication bypass.
**Escalation:** Planned to forge a valid OAMAuthnCookie via the encryption oracle to bypass authentication.
**Insight:** When a target fingerprints as a known product with a public padding-oracle CVE, adapting an existing PoC often just needs small request tweaks (e.g. consent-bypass params) to reach the vulnerable code path.