Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Summary
Attackers exploited a SQL injection vulnerability in an Oracle database to gain unauthorized access. Instead of writing executables to disk, they compiled Java source code directly within Oracle, allowing them to execute commands from inside the database engine and install a post-exploitation toolkit.
IFF Assessment
This article details a sophisticated attack method that bypasses traditional security measures, posing a significant threat to organizations relying on Oracle databases.
Severity
This score reflects a high severity, considering the SQL injection vulnerability (attack vector: network) leading to privileges escalation to SYSTEM level (impact: high) and the novel method of in-database compilation which suggests a high exploitability.
Defender Context
This incident highlights the risk of SQL injection flaws, especially in public-facing applications. Defenders should prioritize patching such vulnerabilities and implement robust input validation. The technique of in-database compilation for post-exploitation is an advanced evasion tactic that security monitoring systems may need to specifically look for.