CVE-2023-21894: Oracle GLM NextGen OUI Privilege Escalation

CVE-2023-21894 Overview

CVE-2023-21894 affects the Oracle Global Lifecycle Management NextGen OUI Framework, a component of Oracle Fusion Middleware. The flaw resides in the NextGen Installer and impacts all versions prior to 13.9.4.2.11. A low-privileged attacker with local logon access to the infrastructure where the framework executes can compromise the product. Exploitation requires interaction from a user other than the attacker. Successful attacks result in full takeover of the Oracle Global Lifecycle Management NextGen OUI Framework, with high impact to confidentiality, integrity, and availability. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
Successful exploitation grants takeover of the Oracle Global Lifecycle Management NextGen OUI Framework, exposing installation processes and downstream Fusion Middleware deployments.

Affected Products

Oracle Global Lifecycle Management NextGen OUI Framework versions prior to 13.9.4.2.11
Oracle Fusion Middleware deployments using the NextGen Installer component
Environments where the NextGen OUI Framework is invoked during patch or install operations

Discovery Timeline

2023-01-17 - Oracle releases Critical Patch Update addressing the vulnerability
2023-01-18 - CVE-2023-21894 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-21894

Vulnerability Analysis

The vulnerability resides in the NextGen Installer component of the Oracle Global Lifecycle Management NextGen OUI Framework. The framework orchestrates installation, patching, and lifecycle operations across Oracle Fusion Middleware products. An attacker who already holds a low-privileged local account on the host can leverage the flaw to escalate control over the installer framework itself.

Exploitation is not fully automated. The attack requires a separate user, typically an administrator running an install or patch task, to interact with attacker-controlled input or files. When that interaction occurs, the attacker gains the same level of trust granted to the installer process. This trust extends to file system writes, configuration changes, and subsequent component installs.

The combination of local attack vector, low privilege requirement, and user interaction maps to [CWE-284] Improper Access Control. The framework does not adequately segregate untrusted input or files from privileged installer routines.

Root Cause

The root cause is improper access control within the NextGen Installer routines. The framework trusts inputs or artifacts that a low-privileged local user can influence, then consumes them under elevated installer context.

Attack Vector

The attacker must have local logon access to the server hosting the framework. The attacker stages malicious inputs or files in a path consumed by the installer. When a higher-privileged user runs an installation or patching workflow, the installer processes the staged content. The framework is taken over with the privileges of the invoking user.

No verified public proof-of-concept is available. See the Oracle Critical Patch Update Advisory - January 2023 for vendor-supplied details.

Detection Methods for CVE-2023-21894

Indicators of Compromise

Unexpected files or directories created by low-privileged users in paths consumed by the NextGen Installer
Installer or patch sessions that spawn child processes outside documented Oracle binaries
Modifications to OUI inventory, response files, or staging directories made outside change windows

Detection Strategies

Audit file integrity on Oracle Home directories, OUI inventory locations, and NextGen Installer staging paths
Correlate local logon events with subsequent installer invocations by privileged accounts
Hunt for process trees where Oracle installer binaries spawn shells, scripting interpreters, or network utilities

Monitoring Recommendations

Forward OS-level file access and process telemetry from Oracle Fusion Middleware hosts to a central analytics platform
Alert on writes to installer-controlled paths by non-Oracle service accounts
Track invocations of the NextGen OUI Framework and validate them against scheduled maintenance windows

How to Mitigate CVE-2023-21894

Immediate Actions Required

Apply the Oracle January 2023 Critical Patch Update to upgrade the NextGen OUI Framework to version 13.9.4.2.11 or later
Restrict interactive local logon on hosts running Oracle Fusion Middleware to administrators only
Review and tighten file system permissions on OUI inventory, staging, and response file directories

Patch Information

Oracle addressed CVE-2023-21894 in the January 2023 Critical Patch Update. Upgrade the Oracle Global Lifecycle Management NextGen OUI Framework to version 13.9.4.2.11 or later. Refer to the Oracle Critical Patch Update Advisory - January 2023 for patch download details and applicability matrices.

Workarounds

Limit local accounts on Fusion Middleware hosts and disable shared interactive logons
Run installer and patching workflows only from controlled administrator sessions on hardened jump hosts
Enforce least privilege on Oracle installation directories and verify ownership before each install

bash

# Restrict access to Oracle Home and OUI inventory directories
chown -R oracle:oinstall /u01/app/oracle
chmod -R 750 /u01/app/oracle
chmod 770 /u01/app/oraInventory