Tech giant Oracle has issued a stark warning to its corporate clients regarding a critical security flaw within its widely used PeopleSoft software. This advisory comes swiftly after a prominent cybercrime group, ShinyHunters, publicly claimed responsibility for exploiting the vulnerability in a large-scale hacking operation.
The vulnerability, which Oracle described in a security advisory on Thursday, affects PeopleSoft software, a system extensively adopted by large organisations for managing critical functions such as payroll and human resources. Worryingly, the flaw can be exploited remotely over the internet without requiring any authentication, such as a password, making it particularly dangerous.
Mandiant, the cybersecurity unit owned by Google, corroborated the claims, stating in a blog post that the newly identified Oracle flaw is indeed the same bug being leveraged by the ShinyHunters group. Mandiant has proactively informed more than 100 global organisations, predominantly in the United States, about their potentially vulnerable systems, urging them to restrict access.
The cybercrime gang had previously informed TechCrunch that they had compromised companies by abusing an unpatched flaw in PeopleSoft servers. This type of vulnerability is known as a 'zero-day' because the affected company, in this instance Oracle, had no prior warning or opportunity to fix it before its discovery and exploitation by malicious actors.
While Oracle has yet to release a definitive patch for the vulnerability, it has recommended that customers utilising PeopleSoft software implement specific mitigations to prevent exploitation. Mandiant noted that while some organisations successfully blocked the malicious activity or remediated the vulnerabilities, others experienced compromises, leading to stolen data being published on the ShinyHunters' data leak website.
A significant proportion, approximately two-thirds, of the organisations notified by Mandiant are in the higher education sector, aligning with earlier claims made by ShinyHunters. The group reportedly claimed to have stolen hundreds of thousands of student records, including full names, home addresses, phone numbers, emails, dates of birth, and academic details, from some of the compromised educational institutions.