CVE-2022-21587: Oracle E-Business Suite Auth Bypass Flaw

CVE-2022-21587 Overview

CVE-2022-21587 is a critical unauthenticated arbitrary file upload vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite. The vulnerability exists in the Upload component and allows unauthenticated attackers with network access via HTTP to completely compromise the affected system. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Critical Impact

This vulnerability enables unauthenticated remote attackers to achieve complete system takeover of Oracle Web Applications Desktop Integrator, resulting in full compromise of confidentiality, integrity, and availability of the affected E-Business Suite deployment.

Affected Products

• Oracle E-Business Suite versions 12.2.3 through 12.2.11
• Oracle Web Applications Desktop Integrator (Upload component)

Discovery Timeline

• 2022-10-18 - CVE CVE-2022-21587 published to NVD
• 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2022-21587

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The Oracle Web Applications Desktop Integrator's Upload component fails to properly authenticate requests before processing file uploads. This authentication bypass allows remote attackers to upload arbitrary files to the server without any credentials, effectively providing a direct path to remote code execution.

The exploitation of this vulnerability is straightforward and does not require any authentication, user interaction, or special privileges. An attacker can leverage this flaw to upload malicious web shells or executable files, gaining persistent access and control over the compromised Oracle E-Business Suite environment.

Root Cause

The root cause is missing authentication controls in the Upload component of Oracle Web Applications Desktop Integrator. Critical file upload functionality is exposed without requiring proper user authentication, violating the principle of defense in depth. The component processes incoming file uploads and writes them to the server without verifying the identity or authorization level of the requesting user.

Attack Vector

The attack is network-based and requires only HTTP access to the vulnerable Oracle E-Business Suite instance. An attacker can craft malicious HTTP requests targeting the Upload component to submit arbitrary files. Since no authentication is required, the attack can be executed from any network location with connectivity to the target system.

The exploitation flow typically involves:

1. Identifying an exposed Oracle E-Business Suite instance running versions 12.2.3-12.2.11
2. Sending crafted HTTP requests to the Web Applications Desktop Integrator Upload endpoint
3. Uploading a malicious payload (e.g., web shell or executable) to the server
4. Executing the uploaded payload to gain persistent access or perform further malicious actions

For detailed technical information on exploitation mechanics, refer to the Packet Storm Security Report.

Detection Methods for CVE-2022-21587

Indicators of Compromise

• Unexpected files appearing in Oracle E-Business Suite upload directories or web-accessible paths
• Web shells or suspicious executable files with recent creation timestamps on EBS servers
• HTTP POST requests to the Web Applications Desktop Integrator Upload endpoints from external or unexpected IP addresses
• Anomalous outbound network connections from Oracle E-Business Suite application servers

Detection Strategies

• Monitor HTTP access logs for requests targeting the Web Applications Desktop Integrator Upload component, especially from unauthenticated sessions
• Implement file integrity monitoring on Oracle E-Business Suite directories to detect unauthorized file uploads
• Deploy web application firewall (WAF) rules to detect and block suspicious file upload attempts
• Review authentication logs for patterns indicating bypass attempts or missing authentication tokens

Monitoring Recommendations

• Enable verbose logging for the Oracle Web Applications Desktop Integrator component
• Configure SIEM alerting for anomalous file upload activity and new file creation events on EBS servers
• Monitor for post-exploitation indicators such as web shell callbacks, reverse shell connections, or lateral movement attempts
• Regularly audit user sessions and access patterns for the E-Business Suite environment

How to Mitigate CVE-2022-21587

Immediate Actions Required

• Apply the Oracle Critical Patch Update (CPU) from October 2022 immediately to all affected Oracle E-Business Suite instances
• If patching is not immediately possible, restrict network access to the Web Applications Desktop Integrator component
• Audit Oracle E-Business Suite servers for signs of compromise, including unauthorized files in upload directories
• Implement network segmentation to limit exposure of E-Business Suite systems to untrusted networks

Patch Information

Oracle has released a security patch for this vulnerability as part of the October 2022 Critical Patch Update. Organizations running Oracle E-Business Suite versions 12.2.3 through 12.2.11 should apply this patch as the primary remediation measure. For detailed patch information and download instructions, refer to the Oracle Security Alert - October 2022.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, federal agencies and critical infrastructure organizations are required to apply remediations according to CISA's binding operational directives.

Workarounds

• Implement firewall rules to restrict access to Oracle Web Applications Desktop Integrator endpoints to trusted IP addresses only
• Disable the Upload functionality in Web Applications Desktop Integrator if it is not business-critical
• Deploy a web application firewall (WAF) with rules to block malicious file upload attempts targeting the vulnerable component
• Enable additional authentication layers such as VPN or multi-factor authentication for accessing E-Business Suite applications

# Example: Restrict access to Oracle EBS at the network level (iptables)
# Replace <TRUSTED_IP_RANGE> with your organization's trusted IP addresses
iptables -A INPUT -p tcp --dport 80 -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP