CVE-2022-39412: Oracle Access Manager Auth Bypass Flaw

CVE-2022-39412 Overview

CVE-2022-39412 affects the Admin Console component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over HTTP to compromise confidentiality on the affected system. Oracle disclosed the issue in the October 2022 Critical Patch Update. The weakness is categorized under [CWE-306] Missing Authentication for Critical Function. Successful exploitation can result in unauthorized access to critical data or complete read access to all data accessible through Oracle Access Manager. The vulnerability affects Oracle Access Manager version 12.2.1.4.0.

Critical Impact

Unauthenticated remote attackers can read sensitive identity and access management data from Oracle Access Manager over the network.

Affected Products

• Oracle Access Manager 12.2.1.4.0
• Oracle Fusion Middleware (Admin Console component)
• Deployments exposing the Oracle Access Manager Admin Console over HTTP/HTTPS

Discovery Timeline

• 2022-10-18 - CVE-2022-39412 published to NVD as part of the Oracle October 2022 Critical Patch Update
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-39412

Vulnerability Analysis

The vulnerability resides in the Admin Console component of Oracle Access Manager (OAM), an identity and access management product within Oracle Fusion Middleware. An attacker reaches the vulnerable endpoint over the network using HTTP without supplying credentials or interacting with a user. The flaw exposes confidentiality only, with no impact to integrity or availability. Because OAM brokers authentication for downstream Oracle and third-party applications, the data it stores and processes is sensitive by design. Exposure of session data, configuration details, or policy information can support follow-on attacks against federated applications.

Root Cause

The underlying weakness is classified as [CWE-306] Missing Authentication for Critical Function. A function within the Admin Console that should require authentication can be invoked by an unauthenticated client. The function returns data that should be restricted to administrators or authorized callers. Oracle's advisory does not disclose the specific endpoint or parameter, consistent with their standard Critical Patch Update disclosure practice.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker sends crafted HTTP requests to the Oracle Access Manager Admin Console interface. No authentication, privileges, or user interaction are required. The scope is unchanged, meaning the compromise stays within the OAM security context, but that context contains data with direct security implications for protected applications. Exploitation can be performed remotely from any host that can reach the Admin Console port. The EPSS score of 4.251% (88.9 percentile) indicates higher-than-average exploitation probability relative to other CVEs.

No public proof-of-concept or exploit code has been published for this CVE. Technical details remain limited to the vendor advisory; see the Oracle Critical Patch Update Advisory - October 2022 for vendor guidance.

Detection Methods for CVE-2022-39412

Indicators of Compromise

• Unauthenticated HTTP requests to Oracle Access Manager Admin Console URIs originating from untrusted networks
• Anomalous outbound data volume from OAM servers following inbound requests to administrative endpoints
• Access log entries showing successful HTTP 200 responses to administrative paths without preceding authentication
• Requests to OAM management endpoints from IP addresses not associated with administrative workstations

Detection Strategies

• Review Oracle Access Manager access logs for requests to Admin Console paths that lack a valid authenticated session cookie or token
• Compare current OAM version against 12.2.1.4.0 and verify the October 2022 CPU bundle patch is applied
• Inspect web application firewall (WAF) logs for HTTP requests targeting OAM administrative URIs from non-administrative source ranges
• Correlate network flow data with OAM server IPs to identify unexpected external HTTP connections to management ports

Monitoring Recommendations

• Forward OAM, WebLogic, and OHS access logs to a centralized SIEM for retention and alerting on administrative path access
• Alert on HTTP requests to OAM Admin Console URIs that do not originate from the documented administrative subnet
• Monitor for new or unusual authentication policy reads, federation metadata downloads, or configuration export operations
• Track failed and successful administrative actions to establish a baseline and flag deviations

How to Mitigate CVE-2022-39412

Immediate Actions Required

• Apply the Oracle October 2022 Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 instances
• Restrict network access to the OAM Admin Console to a dedicated administrative network or jump host
• Audit access logs for the period prior to patching to identify any unauthenticated access attempts
• Rotate any credentials, tokens, or secrets that may have been exposed through the Admin Console

Patch Information

Oracle addressed CVE-2022-39412 in the October 2022 Critical Patch Update. Customers running Oracle Access Manager 12.2.1.4.0 must apply the CPU patch bundle associated with their Fusion Middleware deployment. Refer to the Oracle Critical Patch Update Advisory - October 2022 for patch identifiers, supported configurations, and post-installation steps. Oracle strongly recommends applying CPU patches without delay because reverse engineering of fixes can produce working exploits.

Workarounds

• Place the OAM Admin Console behind a reverse proxy or WAF that enforces source-IP allow-listing for administrative paths
• Block external access to OAM management ports at the perimeter firewall until patches are applied
• Require VPN or zero-trust network access for all connections to the OAM Admin Console
• Disable or isolate the Admin Console on production OAM nodes where it is not actively required

# Configuration example: restrict Admin Console access at the network edge
# Apache/OHS allow-list for OAM Admin Console paths
<LocationMatch "^/oamconsole">
    Require ip 10.10.20.0/24
    Require ip 10.10.21.0/24
</LocationMatch>

# iptables example to limit access to the OAM admin port
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP