Hackers Deploy Khunt Post‑Exploitation Toolkit via Oracle Database SQL Injection

Hackers Deploy Khunt Post‑Exploitation Toolkit via Oracle Database SQL Injection

What Happened – Attackers exploited an un‑validated autocomplete endpoint in a public‑facing Java application running on Apache Tomcat. The SQL‑injection flaw let them issue arbitrary SQL commands against an Oracle database, where they stored and compiled the malicious khunt post‑exploitation toolkit as a Java object. From the database they executed OS commands, harvested Windows registry hives and enumerated services, achieving SYSTEM‑level access on the host server.

Why It Matters for Compliance & Audit Readiness

• Demonstrates a failure of application‑level input‑validation controls that SOC 2 expects under CC6.1 – System Operations and CC5.1 – Logical Access.
• Highlights the need for continuous evidence that database objects and privileged commands are monitored, a core requirement for Control Mapping and audit‑ready evidence collection.
• Shows how a single injection can bypass traditional perimeter defenses, underscoring the importance of continuous control monitoring to prove that security policies are enforced in real time.

Who Is Affected – Primarily enterprises that run Oracle databases behind web‑applications (technology SaaS, financial services, healthcare, and other data‑intensive sectors).

Recommended Actions

• Immediately review and harden all web‑application input validation, especially autocomplete/search endpoints.
• Disable or tightly restrict Oracle’s CREATE JAVA SOURCE capability unless explicitly required.
• Deploy database‑level monitoring that logs creation of Java objects and privileged SQL commands; map these logs to SOC 2 control evidence.
• Conduct a control‑mapping exercise to ensure CC5.1, CC6.1, and CC7.1 are fully documented and continuously verified.

Source: BleepingComputer

Technical Notes

• Attack vector: SQL injection via vulnerable search‑engine endpoint in a Java/Tomcat app.
• Mechanism: Abuse of Oracle’s embedded JVM and CREATE JAVA SOURCE to store malicious Java code as a schema object, then execute OS commands via KhuntCmd.
• Data/credentials impacted: Windows SAM, SECURITY, and SYSTEM registry hives (potential credential dumping).

Source: BleepingComputer