CVE-2023-21975: Oracle APEX Auth Bypass Vulnerability

CVE-2023-21975 Overview

CVE-2023-21975 affects the Application Express Customers Plugin component of Oracle Application Express (APEX), versions 18.2 through 22.2. The vulnerability resides in the User Account subcomponent and allows a low-privileged attacker with network access over HTTP to compromise the plugin. Successful exploitation requires user interaction from a victim other than the attacker. Because the vulnerability produces a scope change, attacks can impact resources beyond the vulnerable component itself, leading to full takeover of the Application Express Customers Plugin and significant downstream effects on confidentiality, integrity, and availability.

Critical Impact

A low-privileged authenticated attacker can take over the Application Express Customers Plugin through a network-based HTTP attack requiring victim interaction, with confirmed scope change affecting additional Oracle products.

Affected Products

• Oracle Application Express Customers Plugin 18.2
• Oracle Application Express Customers Plugin versions 19.x through 21.x
• Oracle Application Express Customers Plugin 22.2

Discovery Timeline

• 2023-07-18 - Oracle disclosed the vulnerability in the July 2023 Critical Patch Update
• 2023-07-18 - CVE-2023-21975 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-21975

Vulnerability Analysis

The vulnerability exists in the User Account subcomponent of the Oracle Application Express Customers Plugin. Oracle APEX is a low-code web development framework that runs inside Oracle Database and exposes applications over HTTP. The Customers Plugin is a packaged sample application used to manage customer records. NVD classifies the weakness as NVD-CWE-noinfo, meaning Oracle did not publish a specific CWE category.

The attacker authenticates with low privileges, then triggers the flaw by inducing a separate user to interact with attacker-controlled input. The scope change indicates that code in the vulnerable security authority (the plugin) acts on resources managed by a different authority, such as the APEX workspace or backing database schema. Exploitation results in compromise of the plugin and downstream impact across linked components.

Root Cause

Oracle has not published a detailed root-cause analysis. The combination of required user interaction, scope change, and high impact on confidentiality, integrity, and availability is consistent with a client-side injection or session-riding pattern, such as stored cross-site scripting or cross-site request forgery against an administrative function in the User Account workflow.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker with minimal privileges submits crafted content to the Customers Plugin. A second user, typically a higher-privileged operator, must view or act on that content. The attacker then inherits the victim's effective permissions inside the plugin and pivots into adjacent APEX resources.

No verified proof-of-concept code is available for this vulnerability. Refer to the Oracle Critical Patch Update July 2023 advisory for vendor-supplied details.

Detection Methods for CVE-2023-21975

Indicators of Compromise

• Unexpected creation or modification of APEX user accounts, workspaces, or application items within the Customers Plugin.
• HTTP requests to Customers Plugin endpoints containing script tags, event handlers, or encoded payloads in user-supplied fields.
• Session activity from a single account spanning multiple privilege levels in short time windows.

Detection Strategies

• Inspect APEX access logs and ORDS (Oracle REST Data Services) request logs for anomalous POST and GET requests targeting Customers Plugin pages and AJAX callbacks.
• Correlate authentication events with administrative actions to identify privilege boundary crossings consistent with the scope change described in the CVSS vector.
• Monitor database audit trails for unexpected DML against APEX dictionary tables and customer data tables.

Monitoring Recommendations

• Enable APEX activity logging and forward records to a centralized SIEM for retention and correlation.
• Alert on HTTP responses containing reflected user input from Customers Plugin endpoints.
• Track changes to APEX administrator and developer accounts and to plugin configuration tables.

How to Mitigate CVE-2023-21975

Immediate Actions Required

• Apply the Oracle July 2023 Critical Patch Update to all Application Express deployments running versions 18.2 through 22.2.
• Inventory APEX environments to confirm which workspaces deploy the Customers Plugin sample application.
• Restrict access to APEX administration and developer interfaces to trusted networks and authenticated administrators.

Patch Information

Oracle addressed CVE-2023-21975 in the Oracle Critical Patch Update July 2023. Administrators should upgrade Application Express to a fixed release and validate that the Customers Plugin sample application has been updated or removed from production workspaces.

Workarounds

• Remove the Customers Plugin sample application from production APEX workspaces where it is not required.
• Place a web application firewall in front of ORDS and APEX endpoints to filter script payloads and enforce same-origin controls on state-changing requests.
• Enforce least privilege on APEX accounts and disable self-service workflows in the Customers Plugin until the patch is applied.

# Configuration example
# Refer to the Oracle Critical Patch Update July 2023 advisory for
# product-specific patch identifiers and upgrade procedures:
# https://www.oracle.com/security-alerts/cpujul2023.html