Oracle WebCenter Content CheckOutAndOpen ActiveX openWebdav Arbitrary File Code Execution Exploit

Oracle WebCenter Content is prone to a Remote File Execution vulnerability within the CheckOutAndOpen.dll ActiveX when using openWebdav method. By specifying a constructed path an attacker can force the contents of the file to be passed to ShellExecuteExW, thus being able to execute arbitrary files. The payload is embedded on a VBS file which is automatically executed when a HTA file is requested through Webdav. This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.