🔴 Critical | Source: The Hacker News
Attackers exploited a SQL injection vulnerability in a public-facing web application to gain access to an Oracle database, then used a post-exploitation toolkit called ‘khunt’ to execute commands directly inside the database engine by compiling Java source code into stored schema objects — no executable written to disk. This technique effectively turns the Oracle database process itself into a command execution environment, bypassing many traditional endpoint detection controls. The attack ultimately resulted in SYSTEM-level access on the underlying Windows host, dramatically escalating the blast radius beyond the database.
Security Architect’s Take: Audit Oracle database instances for unauthorised Java stored procedures and schema objects immediately, and enforce the principle of least privilege on database service accounts to prevent OS-level command execution via DBMS_JAVA or UTL_FILE. Ensure public-facing web applications undergo regular SQL injection testing and consider deploying a WAF with virtualised patching as a compensating control while remediation is in progress.
Original advisory: Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access