CVE-2021-2328: Oracle Text Privilege Escalation Flaw

CVE-2021-2328 Overview

CVE-2021-2328 is a high-severity vulnerability in the Oracle Text component of Oracle Database Server. The flaw affects supported versions 12.1.0.2, 12.2.0.1, and 19c. An authenticated attacker holding Create Any Procedure and Alter Any Table privileges can exploit the issue over Oracle Net to fully compromise Oracle Text. Oracle addressed the issue in the July 2021 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of Oracle Text, with high impact to confidentiality, integrity, and availability of the affected component.

Affected Products

Oracle Text 12.1.0.2
Oracle Text 12.2.0.1
Oracle Text 19c

Discovery Timeline

2021-07-21 - Oracle published the July 2021 Critical Patch Update addressing CVE-2021-2328
2021-07-21 - CVE-2021-2328 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-2328

Vulnerability Analysis

The vulnerability resides in Oracle Text, the full-text indexing and search component embedded in Oracle Database Server. An attacker exploits the flaw through Oracle Net, the database's network protocol for client-server communication. Exploitation requires high privileges, specifically the Create Any Procedure and Alter Any Table system privileges. These privileges are typically granted to application owners, schema administrators, or DBAs.

The attack does not require user interaction, and the scope is unchanged. Once exploited, the attacker gains full control over the Oracle Text component, allowing arbitrary read, modification, and disruption of data managed by that component. The EPSS score is approximately 1.4%, placing it in the 80th percentile for likelihood of exploitation, though no public exploit code or in-the-wild activity has been reported.

Root Cause

Oracle has not disclosed the underlying defect class, and the CWE is recorded as NVD-CWE-noinfo. Based on the privileges required and the attack mechanics, the flaw likely involves unsafe handling of attacker-controlled SQL objects or procedure logic processed by the Oracle Text indexing pipeline. An attacker with privileges to create procedures and alter tables can stage objects that the Text component processes in a privileged context.

Attack Vector

The attack is remote over Oracle Net but requires authenticated access with elevated privileges. A malicious schema owner or compromised administrative account creates procedures or alters table structures referenced by Oracle Text indexes. When the Text component processes those structures, the attacker's logic executes in a context capable of compromising the component.

No verified public proof-of-concept code is available for CVE-2021-2328. Refer to the Oracle Critical Patch Update July 2021 advisory for vendor-confirmed remediation details.

Detection Methods for CVE-2021-2328

Indicators of Compromise

Unexpected CREATE PROCEDURE or ALTER TABLE statements issued against schemas that own Oracle Text indexes.
Unauthorized DDL activity from accounts that hold Create Any Procedure or Alter Any Table privileges.
Anomalous Oracle Text index rebuild or synchronization operations referencing newly created procedures.

Detection Strategies

Enable Oracle Database Unified Auditing for DDL operations on objects associated with CTXSYS and any schema using Oracle Text indexes.
Review DBA_SYS_PRIVS and DBA_ROLE_PRIVS for accounts holding CREATE ANY PROCEDURE or ALTER ANY TABLE to validate least-privilege posture.
Correlate Oracle Net session logs with administrative DDL events to identify suspicious privileged sessions.

Monitoring Recommendations

Forward Oracle audit trails to a centralized SIEM and alert on DDL by non-administrative service accounts.
Monitor for changes to Oracle Text dictionary objects under the CTXSYS schema.
Track failed and successful logons over Oracle Net for accounts with elevated privileges and alert on off-hours activity.

How to Mitigate CVE-2021-2328

Immediate Actions Required

Apply the Oracle July 2021 Critical Patch Update to all affected database instances running versions 12.1.0.2, 12.2.0.1, or 19c.
Audit and revoke CREATE ANY PROCEDURE and ALTER ANY TABLE privileges from accounts that do not require them.
Rotate credentials for any privileged database accounts that may have been exposed.

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update July 2021. Administrators should apply the corresponding database patch set update (PSU) or release update (RU) for their version and restart affected instances per Oracle's installation guidance.

Workarounds

Restrict network access to Oracle Net listeners using sqlnet.oratcp.invited_nodes allow-listing to limit which hosts can reach the database.
Enforce least privilege by replacing broad ANY privileges with object-scoped grants where feasible.
Disable or drop Oracle Text indexes in databases that do not require full-text search functionality until patching is complete.

bash

# Example: restrict Oracle Net access via sqlnet.ora
tcp.validnode_checking = yes
tcp.invited_nodes = (10.0.0.10, 10.0.0.11, app-server.example.com)

# Example: review high-risk privilege grants
sqlplus / as sysdba <<EOF
SELECT grantee, privilege FROM dba_sys_privs
 WHERE privilege IN ('CREATE ANY PROCEDURE','ALTER ANY TABLE')
 ORDER BY grantee;
EOF