Oracle Access Manager ADF Faces Deserialization Vulnerability Remote Code Execution Exploit

This module exploits a server side request forgery present in getKeyInfoData function of oracle.security.xmlsec.keys.RetrievalMethod. Chained with a deserialization vulnerability present in the ADF Faces framework to deploy an agent in the system running Oracle Access Manager.
CVE Link
CVE-2022-21445
CVE-2022-21497
Exploit Platform
Windows
Linux
Exploit Type
Exploits
Remote Code Execution
Product Name
Impact