CVE-2025-30724: Oracle BI Publisher Information Disclosure

CVE-2025-30724 Overview

CVE-2025-30724 is an information disclosure vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically within the XML Services component. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher and gain unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the XML Services component improperly handles access controls, allowing attackers to retrieve sensitive information without authentication.

Critical Impact

Unauthenticated remote attackers can access critical data or gain complete access to all Oracle BI Publisher accessible data via HTTP network access.

Affected Products

• Oracle BI Publisher 7.6.0.0.0
• Oracle BI Publisher 12.2.1.4.0

Discovery Timeline

• April 15, 2025 - CVE-2025-30724 published to NVD
• April 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30724

Vulnerability Analysis

This vulnerability resides in the XML Services component of Oracle BI Publisher and represents an information disclosure flaw. The weakness allows unauthenticated attackers to access sensitive data through the network without requiring any user interaction or special privileges.

The vulnerability's characteristics indicate that exploitation is straightforward and reliable. An attacker only needs network access to the vulnerable Oracle BI Publisher instance via HTTP to launch an attack. No authentication credentials or prior system access is required, making this vulnerability particularly dangerous in environments where Oracle BI Publisher is exposed to untrusted networks.

The impact is focused entirely on confidentiality—successful exploitation results in unauthorized access to critical data or potentially complete access to all data accessible through Oracle BI Publisher. Organizations using BI Publisher for reporting and analytics may have significant amounts of sensitive business data at risk.

Root Cause

The root cause of CVE-2025-30724 lies in improper access control within the XML Services component of Oracle BI Publisher. The component fails to properly validate or restrict access to sensitive data resources when processing XML-related requests. This allows unauthenticated users to bypass intended security restrictions and access data that should require proper authentication.

The CWE-200 classification indicates that sensitive information is being exposed to unauthorized actors, suggesting that the XML Services component does not adequately enforce authentication requirements before serving data or provides excessive information in responses that can be leveraged by attackers.

Attack Vector

The attack vector for this vulnerability is network-based, requiring only HTTP access to the vulnerable Oracle BI Publisher instance. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the XML Services component.

The attack flow typically involves:

1. Identifying an exposed Oracle BI Publisher instance running a vulnerable version
2. Sending unauthenticated HTTP requests to the XML Services endpoint
3. Receiving sensitive data in the response without requiring authentication
4. Potentially iterating to access additional data or escalate the information gathering

Since no user interaction is required and the attack complexity is low, this vulnerability can be reliably exploited by remote attackers who can reach the target system over the network.

Detection Methods for CVE-2025-30724

Indicators of Compromise

• Unusual or unauthorized HTTP requests to Oracle BI Publisher XML Services endpoints from external or unexpected IP addresses
• Abnormal data access patterns or high volumes of XML Services requests without corresponding authenticated sessions
• Log entries showing successful data retrieval from XML Services without valid authentication tokens
• Network traffic indicating data exfiltration following unauthenticated access to BI Publisher

Detection Strategies

• Monitor HTTP access logs for Oracle BI Publisher, specifically tracking requests to XML Services endpoints that lack valid authentication
• Implement network-based detection rules to identify reconnaissance or exploitation attempts targeting BI Publisher
• Configure SIEM rules to alert on unauthenticated access attempts to sensitive Oracle BI Publisher components
• Deploy web application firewalls (WAF) with rules to detect and block suspicious XML Services requests

Monitoring Recommendations

• Enable detailed logging for all Oracle BI Publisher access, including XML Services component activity
• Implement real-time alerting for unauthenticated access attempts to protected resources
• Regularly review access logs for patterns indicative of information gathering or data exfiltration
• Monitor network traffic for large data transfers from Oracle BI Publisher to unexpected destinations

How to Mitigate CVE-2025-30724

Immediate Actions Required

• Apply the Oracle Critical Patch Update (CPU) April 2025 security patches immediately to address this vulnerability
• Restrict network access to Oracle BI Publisher instances, limiting exposure to trusted networks only
• Implement network segmentation to isolate Oracle BI Publisher from untrusted network segments
• Review and audit current Oracle BI Publisher access logs for signs of exploitation

Patch Information

Oracle has released security patches for this vulnerability as part of the April 2025 Critical Patch Update. Organizations running affected versions (7.6.0.0.0 or 12.2.1.4.0) should apply the patches immediately. Detailed patching instructions and the security advisory are available from Oracle's April 2025 Critical Patch Update Advisory.

Workarounds

• Implement network access controls to restrict HTTP access to Oracle BI Publisher from untrusted sources
• Deploy a reverse proxy or web application firewall in front of Oracle BI Publisher to filter malicious requests
• Disable or restrict access to the XML Services component if not required for business operations
• Enable additional authentication layers such as VPN requirements for accessing Oracle BI Publisher

# Example: Restrict network access to Oracle BI Publisher using iptables
# Allow only trusted internal network to access BI Publisher HTTP port
iptables -A INPUT -p tcp --dport 9502 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP

# Example: Block external access to XML Services endpoint via Apache mod_rewrite
# Add to Apache configuration for BI Publisher
<Location "/xmlpserver">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
</Location>