CVE-2025-61757: Oracle Identity Manager Exploit Activity Observed in September

Summary

The write-up details an authentication bypass flaw in Oracle Identity Manager that lets unauthenticated actors reach arbitrary URLs by appending a “;.wadl” suffix, ultimately enabling remote code execution. The vulnerability (CVE-2025-61757) was observed being probed and exploited in the wild before Oracle shipped a fix. Analysts recorded multiple scanning IPs issuing POST requests with a distinctive user-agent string. Follow-on activity also included probes for an additional Oracle bug (CVE-2025-4581) and attempts to trigger Log4j exploits.

Investigation

Log analysis revealed repeated POST requests to Oracle Identity Manager endpoints ending in “;.wadl” throughout the period from late August to early September 2025. All of these requests shared an identical user-agent value, pointing to a common scanner or toolkit. Each request carried a payload with a consistent length of 556 bytes, although the bodies themselves were not stored. The same source also probed URLs associated with other known vulnerabilities, expanding the suspected exploit surface.

CVE-2025-61757 Mitigation

Oracle addressed CVE-2025-61757 in its October Critical Patch Update released on 2025-10-21. Security teams should promptly deploy the latest Oracle patches, enforce strong authentication on all Oracle Identity Manager endpoints, and actively monitor for unusual “;.wadl” request patterns. Additional hardening steps include blocking the identified user-agent string at the edge, constraining POST request sizes, and tightening WADL and related configuration exposure wherever possible.

Response

Configure detections to flag any HTTP traffic that includes the “;.wadl” suffix, focusing on POST requests with roughly 556-byte payloads. Correlate these events with the known user-agent fingerprint and originating IP addresses. Confirm that every Oracle Identity Manager instance in the environment is updated to a patched release and verify that “.wadl” resources are not directly reachable from untrusted networks.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  An attacker, having identified an unpatched Oracle Identity Manager instance, crafts a malicious WADL payload that exploits CVE‑2025‑61757. The payload is exactly 556 bytes long (as required by the proof‑of‑concept) and is sent via HTTP POST to two known vulnerable URIs. To avoid trivial detection heuristics, the attacker mimics a common browser’s user‑agent string. Successful delivery triggers server‑side deserialization, leading to remote code execution.

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # Target host (replace with actual server address)
  TARGET="http://localhost"
  
  # Common browser user‑agent used by the rule
  UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
  
  # Exact 556‑byte malicious payload (simulated with repeated “A” characters)
  PAYLOAD=$(printf 'A%.0s' {1..556})
  
  # Vulnerable endpoints
  ENDPOINTS=(
    "/iam/governance/applicationmanagement/templates;.wadl"
    "/iam/governance/applicationmanagement/api/v1/applications/groovyscriptstatus;.wadl"
  )
  
  for EP in "${ENDPOINTS[@]}"; do
    echo "[*] Sending exploit to $TARGET$EP"
    curl -s -o /dev/null -w "%{http_code}\n" \
         -X POST "$TARGET$EP" \
         -H "User-Agent: $UA" \
         -H "Content-Type: application/xml" \
         -d "$PAYLOAD"
  done
  
  echo "[+] Exploit attempts completed."

• Cleanup Commands:

  # No persistent changes on the web server for this PoC.
  # Remove any temporary files created locally.
  rm -f /tmp/exploit_payload.tmp 2>/dev/null || true
  echo "[*] Cleanup completed."