Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal
CVE-2018-2636 has a selected CVSS score of 8.1 (high); EIP currently links 1 catalogued exploit, 2 repository PoCs, and 1 lab environment.
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
| Product | Source | Version range | Status |
|---|---|---|---|
Hospitality SimphonyBrowse Oracle Corporation / Hospitality Simphony | CVE List | 2.7 | affected |
| 2.8 | affected | ||
| 2.9 | affected |
A single Dockerfile builds a Python 2 Alpine image that runs a custom HTTP server (micros_server.py) simulating an Oracle MICROS Point-of-Sale EGateway service. The server listens on port 8080 and serves static XML/HTML files from a micros/ directory. It is designed as a low-interaction honeypot to detect exploitation attempts for CVE-2018-2636.
Dockerfile:1-11micros_server.py:1-234README.md:1-33The README explicitly states the project is a low-interaction honeypot to detect CVE-2018-2636, a directory traversal vulnerability in Oracle MICROS. The server code includes hardcoded exploit payload constants and logic to parse directory traversal requests, log them, and serve decoy files, which is consistent with a vulnerability research and detection environment.
README.md:1-33micros_server.py:1-234Defines a Python 2 Alpine image, copies requirements.txt and the entire build context into /usr/src/app, installs the click dependency, exposes port 8080, and sets the default command to run micros_server.py.
Dockerfile:1-11A Python 2 script that implements a multithreaded HTTP server (NonBlockingHTTPServer) with a custom handler (MicrosHandler). It serves a WSDL file on GET /EGateway/EGateway.asmx and processes POST requests with Content-Type application/dime. It contains hardcoded hex-encoded exploit payload fragments (poc_suf_*) and checks incoming DIME data for known CVE-2018-2636 exploit patterns. When a directory traversal request is detected, it extracts the requested file path, logs a critical alert with the client IP and file path, and serves a decoy file from the micros/ directory. It also responds to predefined payloads for loglist, micros_info, and db_info with static decoy files.
micros_server.py:1-234Declares a single dependency: click==6.7, which is used by micros_server.py for command-line argument parsing.
requirements.txt:1Contains static XML, HTML, and binary-like files (EGateway.asmx, 404.html, 404, loglist, micros_info, db_info, DbSettings.xml, SimphonyInstall.xml) that are served by the honeypot to mimic a real MICROS EGateway service and provide fake data to attackers.
micros/EGateway.asmx:1-307micros/404.html:1micros/404:1-3micros/loglist:1-156micros/micros_info:1-35micros/db_info:1-10micros/DbSettings.xml:1-73micros/SimphonyInstall.xml:1-77Describes the project as a low-interaction MICROS honeypot for detecting CVE-2018-2636, provides usage instructions, and links to related resources.
README.md:1-33Supported by supplied evidence
The README explicitly states the honeypot detects CVE-2018-2636, a directory traversal vulnerability. The server code includes hardcoded exploit payload constants (poc_suf_*) and logic to parse directory traversal requests, log them, and serve decoy files, which directly supports the association with this CVE.
README.md:1-33micros_server.py:1-234Dockerfile:1-11requirements.txt:1Dockerfile:9micros_server.py:1-234Dockerfile:1-11Dockerfile:11micros_server.py:1-234micros_server.py:1-234micros_server.py:1-234The server only listens on the configured port, serves static decoy files from its own micros/ directory, and logs alerts. It does not execute external commands, access the host filesystem outside its container, connect to external systems, persist data, steal credentials, or exhibit any behavior beyond simulating a vulnerable service and detecting exploit attempts. The Dockerfile does not use privileged mode or mount sensitive host paths.
micros_server.py:1-234Dockerfile:1-11This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.