ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

Researchers have discovered that a critical Oracle PeopleSoft bug exploited by ShinyHunters since May is actually composed of three chained flaws. These flaws were patched by Oracle in June under a single identifier. The root of the issue is a server-side request forgery that is able to reach an internal management interface. This is possible because PeopleSoft trusts its own loopback address, allowing the SSRF to occur. The combination of these three flaws allows for exploitation, which has been taken advantage of by ShinyHunters. Oracle's patch addresses all three flaws, providing a fix for the vulnerability.