CVE-2021-35572
📋 TL;DR
This vulnerability in Oracle Outside In Technology allows unauthenticated attackers to cause denial of service by crashing or hanging the software through specially crafted HTTP requests. It affects any software using Oracle Outside In Technology SDK version 8.5.5. Organizations using Oracle Fusion Middleware or other products incorporating this SDK are vulnerable.
💻 Affected Systems
- Oracle Fusion Middleware (Outside In Technology component)
- Any third-party software using Oracle Outside In Technology SDK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for any application using Outside In Technology, potentially affecting multiple business systems simultaneously if the SDK is widely deployed.
Likely Case
Service disruption for specific applications that process untrusted files via Outside In Technology, leading to application crashes and downtime.
If Mitigated
Limited impact if network access is restricted and input validation prevents malicious payloads from reaching the vulnerable component.
🎯 Exploit Status
Oracle describes this as 'easily exploitable' with unauthenticated network access via HTTP. No public exploit code was found in initial research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches from Oracle Critical Patch Update October 2021 or later
Vendor Advisory: https://www.oracle.com/security-alerts/cpuoct2021.html
Restart Required: Yes
Instructions:
1. Review Oracle Critical Patch Update Advisory October 2021. 2. Download and apply appropriate patches for your Oracle Fusion Middleware installation. 3. Restart affected services. 4. For third-party software using Outside In SDK, contact respective vendors for updates.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to systems using Outside In Technology to trusted sources only
Use firewall rules to limit HTTP access to affected systems
Input Validation
allImplement strict input validation before passing data to Outside In Technology components
🧯 If You Can't Patch
- Implement network controls to restrict access to affected systems from untrusted networks
- Monitor systems for crash/hang events and implement rapid response procedures
🔍 How to Verify
Check if Vulnerable:
Check Oracle Fusion Middleware version and Outside In Technology component version. For third-party software, consult vendor documentation.Check Version:
For Oracle products: opatch lsinventory | grep -i 'outside'Verify Fix Applied:
Verify patch installation via Oracle OPatch utility or check version numbers against patched versions in Oracle advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes or hangs related to Outside In Technology
- Error logs mentioning Outside In Filters component failures
- Unusual HTTP requests to services using Outside In
Network Indicators:
- HTTP requests causing application crashes
- Traffic spikes followed by service unavailability
SIEM Query:
source="*oracle*" AND ("crash" OR "hang" OR "outside in") OR http.status>=500 AND uri.path contains file processing endpoints