CVE-2025-61757

CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager (OIM), part of Oracle Fusion Middleware. The flaw exists in the REST WebServices component, where attackers can bypass authentication filters by appending metadata-style suffixes (;.wadl or ?WSDL) to protected API endpoints. Once authentication is bypassed, attackers exploit a Groovy script compilation endpoint to achieve arbitrary code execution through annotation-processing abuse.

Key Facts

SANS Internet Storm Center observed exploitation attempts in honeypot systems from August 30 to September 9, 2025—occurring before Oracle released its patch—indicating zero-day awareness among threat actors.

Observed Attack Patterns

According to Imperva threat research, attacks have concentrated on organizations in the computing, healthcare, and business services sectors. The highest attack volumes were observed in the United States and France.

Attack Infrastructure Observations

Vulnerable Versions

Enterprise Impact

Oracle Identity Manager is a core enterprise identity governance solution deployed widely across Fortune 500 companies, government agencies, and healthcare organizations. Compromise of OIM can lead to:

• Mass creation of privileged accounts
• Tampering with identity provisioning workflows
• Bypass of MFA and SSO authentication mechanisms
• Lateral movement to connected directory services (AD, LDAP)
• Compromise of integrated SaaS platforms

Vulnerability Mechanism

The vulnerability exploits two weaknesses in Oracle Identity Manager's REST API implementation:

1. Authentication Bypass

OIM's REST security filters incorrectly handle URL paths containing metadata-style suffixes. By appending ;.wadl or ?WSDL to protected endpoints, attackers trick the filter into treating them as publicly accessible WADL/WSDL descriptor requests, bypassing authentication entirely.

2. Groovy Compile-Time Code Execution

Once authentication is bypassed, attackers target the Groovy script validation endpoint. While this endpoint only compiles scripts (without executing them), Groovy's annotation-processing and AST (Abstract Syntax Tree) transform features allow code execution during compilation. Malicious annotations trigger execution before the "no runtime execution" restriction applies.

Exploitation Chain

Vulnerable Endpoints

Exploitation Timeline

Indicators of Compromise

Malicious IP Addresses

The following IPs were observed in exploitation attempts (SANS ISC):

User-Agent Fingerprint

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Note: Chrome 60.x was released in 2017. This severely outdated browser version is anomalous in 2025 traffic and serves as a detection indicator.

Request Characteristics

Detection Queries

Splunk: Detect Authentication Bypass Attempts

index=web_logs sourcetype=access_combined
| where match(uri_path, "(?i)/iam/governance/.*groovyscriptstatus")
| where match(uri_path, "(?i)(;\.wadl|\?WSDL)")
| where http_method="POST"
| stats count by src_ip, uri_path, http_user_agent, bytes_in
| where bytes_in >= 500 AND bytes_in <= 600

KQL (Microsoft Sentinel): OIM Exploitation Detection

CommonSecurityLog
| where RequestURL contains "groovyscriptstatus"
| where RequestURL matches regex @"(?i)(;\.wadl|\?WSDL)"
| where RequestMethod == "POST"
| project TimeGenerated, SourceIP, RequestURL, RequestClientApplication, SentBytes
| where SentBytes between (500 .. 600)

Patching Guidance

Immediate Mitigations

If patching cannot be completed immediately, implement these compensating controls:

WAF Rule: Block Authentication Bypass Suffixes

# Block requests containing bypass suffixes to OIM endpoints
SecRule REQUEST_URI "@rx /iam/governance/.*[;?](\.wadl|WSDL)" \
    "id:2025617571,\
     phase:1,\
     deny,\
     status:403,\
     log,\
     msg:'CVE-2025-61757 - OIM Auth Bypass Attempt'"

Network ACL: Block Known Malicious IPs

# Block IPs associated with exploitation attempts
iptables -A INPUT -s 89.238.132.76 -j DROP
iptables -A INPUT -s 185.245.82.81 -j DROP
iptables -A INPUT -s 138.199.29.153 -j DROP

Additional Hardening

• Restrict OIM Management Access: Limit access to OIM administrative interfaces to trusted networks only
• Enable Enhanced Logging: Configure verbose logging for REST API access attempts
• Monitor Groovy Endpoint: Alert on any POST requests to groovyscriptstatus endpoint
• User-Agent Filtering: Block requests with Chrome 60.x user-agent at edge
• Constrain POST Size: Limit POST request body size to OIM endpoints where practical

Post-Compromise Actions

If exploitation is suspected or confirmed:

1. Audit all OIM accounts - Check for unauthorized privileged account creation
2. Review provisioning workflows - Identify any tampered identity workflows
3. Check connected systems - Audit AD, LDAP, and integrated SaaS platforms for unauthorized changes
4. Review WebLogic logs - Search for evidence of backdoor installation
5. Reset credentials - Change passwords for all OIM administrative accounts
6. Forensic investigation - Assess lateral movement and data exfiltration