Critical Security Bug Exposed in Oracle's PeopleSoft Software

Hackers Have Already Exploited the Flaw to Breach Over 100 Organizations

Oracle has published a security advisory warning of a critical-rated vulnerability in its PeopleSoft software, which was exploited by hackers to breach over 100 organizations. The company is urging its corporate customers to apply mitigations to prevent exploitation.

According to Mandiant, a Google-owned security unit, the new Oracle flaw is the same bug that the ShinyHunters group is abusing in its hacking campaign targeting PeopleSoft customers.

The bug can be exploited over the internet without needing any authentication, such as a password. Oracle has not released a patch for the vulnerability at the time of writing, but has recommended that customers who use PeopleSoft software apply its mitigations to prevent exploitation.

The ShinyHunters group, which took credit for abusing the flaw, has compromised more than 100 organizations that use PeopleSoft servers. Mandiant has notified more than 100 global organizations, most of them in the United States, to restrict access to their potentially vulnerable systems.

The ShinyHunters member told TechCrunch that the gang compromised the companies by abusing an unpatched flaw in PeopleSoft servers. The bug is known as a zero-day because the company affected, in this case Oracle, had no time to fix it before it was discovered and exploited.

Mandiant confirmed that it has also notified more than “100 global organizations,” most of them in the United States, in an effort to restrict access to their potentially vulnerable systems. The cybersecurity group said that about two-thirds of these organizations are in higher education, which aligns with what ShinyHunters previously claimed.

Some of the hacked organizations are universities and colleges. The hacker shared a message they said was sent to one of the victim schools, in which the hackers claimed to have stolen “hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and student ID across all campuses,” among other data.

PeopleSoft, and its customers, are the latest victims in a long series of hacking campaigns where the ShinyHunters gang targeted organizations that all share the same vulnerable software.

In the last year, the group targeted several companies that use Salesforce and Gainsight, as well as software provided by education giant Instructure, and among others. Once the hackers identify vulnerable software and companies that use it, they try to steal corporate or customer data and then threaten to release it unless the victims pay a ransom.

Oracle did not respond to TechCrunch's request for comment.