T1190 Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass)

A web request for the PeopleSoft Environment Management Hub (PSEMHUB) written any way other than the literal /PSEMHUB/: a percent-encoded letter (/%50SEMHUB/hub), mixed or lower case (/psemhub/hub), an encoded slash or a path parameter after it, or a JSP under PSEMHUB or PORTAL. UNC6240 (ShinyHunters) exploits CVE-2026-35273, a Java deserialization flaw in the PSEMHUB hub servlet, and since September 2026 routes around WAF and reverse-proxy rules that match the literal string /PSEMHUB before decoding: WebLogic decodes the path and serves the vulnerable servlet anyway. Before exploiting, the actor sends five to fifteen POST requests to the hub to confirm the host is unpatched, so this fires on reconnaissance that may never be followed by a web shell. Google advises assuming any percent-encoded, mixed-case or otherwise non-normalized variant. EMHub agents in multi-server installs request the literal path, so only the non-canonical forms are the signal; a JSP under PSEMHUB or PORTAL is how the dropped web shells are reached. Match the raw request line, before the logging proxy normalizes it.

Rule ID

d933d5bb-9db8-5657-96dc-5ed0bb53671c

Status

experimental

Level

high

Log source

category: webserver

Date

2026-10-24

Modified

2026-10-24

ATT&CK

T1190 (signal rollup)

Canonical YAML

t1190-peoplesoft-psemhub-encoded-path-exploitation.yml

References

• https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
• https://thrunt.me/hunt/shinyhunters/
• https://attack.mitre.org/techniques/T1190/

False positives

• None expected for the non-canonical path; nothing legitimate encodes or re-cases a static servlet path.
• The JSP selection can match a PeopleSoft build that serves JSP pages under PSEMHUB or PORTAL. Compare against a clean PSEMHUB.war and PORTAL.war before tuning it out.
• EMHub agent traffic in multi-server configurations requests the literal /PSEMHUB/hub path and is excluded by filter_canonical.

Rule YAML

title: 'T1190 Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass)'
id: 'd933d5bb-9db8-5657-96dc-5ed0bb53671c'
status: 'experimental'
description: 'A web request for the PeopleSoft Environment Management Hub (PSEMHUB) written any way other than the literal /PSEMHUB/: a percent-encoded letter (/%50SEMHUB/hub), mixed or lower case (/psemhub/hub), an encoded slash or a path parameter after it, or a JSP under PSEMHUB or PORTAL. UNC6240 (ShinyHunters) exploits CVE-2026-35273, a Java deserialization flaw in the PSEMHUB hub servlet, and since September 2026 routes around WAF and reverse-proxy rules that match the literal string /PSEMHUB before decoding: WebLogic decodes the path and serves the vulnerable servlet anyway. Before exploiting, the actor sends five to fifteen POST requests to the hub to confirm the host is unpatched, so this fires on reconnaissance that may never be followed by a web shell. Google advises assuming any percent-encoded, mixed-case or otherwise non-normalized variant. EMHub agents in multi-server installs request the literal path, so only the non-canonical forms are the signal; a JSP under PSEMHUB or PORTAL is how the dropped web shells are reached. Match the raw request line, before the logging proxy normalizes it.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1190/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.initial_access'
    - 'attack.t1190'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'webserver'
detection:
    # PSEMHUB in any case, any letter optionally percent-encoded, followed by a
    # slash, an encoded slash, a path parameter or the end. No lookahead or
    # inline flags, so the pattern ports to backends with plain regex.
    selection_hub:
        cs-uri-stem|re: '/([pP]|%50|%70)([sS]|%53|%73)([eE]|%45|%65)([mM]|%4[dD]|%6[dD])([hH]|%48|%68)([uU]|%55|%75)([bB]|%42|%62)([/;]|%2[fF]|$)'
    filter_canonical:
        cs-uri-stem|re: '/PSEMHUB(/|$)'
    selection_jsp:
        cs-uri-stem|re: '/(([pP]|%50|%70)([sS]|%53|%73)([eE]|%45|%65)([mM]|%4[dD]|%6[dD])([hH]|%48|%68)([uU]|%55|%75)([bB]|%42|%62)|[pP][oO][rR][tT][aA][lL])(/|%2[fF])[^?]*\.[jJ][sS][pP][xX]?$'
    condition: '(selection_hub and not filter_canonical) or selection_jsp'
falsepositives:
    - 'None expected for the non-canonical path; nothing legitimate encodes or re-cases a static servlet path.'
    - 'The JSP selection can match a PeopleSoft build that serves JSP pages under PSEMHUB or PORTAL. Compare against a clean PSEMHUB.war and PORTAL.war before tuning it out.'
    - 'EMHub agent traffic in multi-server configurations requests the literal /PSEMHUB/hub path and is excluded by filter_canonical.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1190-peoplesoft-psemhub-encoded-path-exploitation.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.