Executive brief
oci-helper is a Java application that manages OCI (Oracle Cloud Infrastructure) configurations. A path traversal vulnerability in the configuration upload function allows authenticated attackers to write files outside the intended directory, potentially leading to system compromise through SSH key replacement, configuration tampering, or cron job injection.
Technical details
A path traversal vulnerability (CWE-22) exists in the addCfg function within OciServiceImpl.java's OCI Configuration Upload component. The vulnerability arises from insufficient input validation on the file path parameter, allowing attackers to use directory traversal sequences (e.g., "../") to write files to arbitrary locations on the filesystem. Authentication is required to exploit this vulnerability, and the attack is performed over the network via the application's HTTP interface. A successful exploit enables arbitrary file write operations, with documented attack scenarios including SSH key replacement for account takeover, application configuration manipulation, and cron job backdoor installation. No patch has been released as the vendor did not respond to early disclosure.
Affected products
- Yohann0617 oci-helper up to 3.2.4
Timeline
- 2025-12-02: disclosed
- other: Public exploit available; vendor unresponsive to disclosure