CVE-2024-20907: Oracle Web Applications Desktop Integrator Auth Bypass

CVE-2024-20907 Overview

CVE-2024-20907 affects the File download component of Oracle Web Applications Desktop Integrator (Web ADI), part of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.13 are affected. An unauthenticated attacker with network access over HTTP can exploit the flaw, but exploitation requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to a subset of Web ADI data, plus unauthorized read access to a subset of data. The scope change indicates impact may extend beyond Web ADI into additional products.

Critical Impact

Unauthenticated network-based exploitation with user interaction can modify and read Web ADI data, with scope change potentially affecting additional Oracle E-Business Suite components.

Affected Products

• Oracle Web Applications Desktop Integrator 12.2.3
• Oracle Web Applications Desktop Integrator versions 12.2.4 through 12.2.12
• Oracle Web Applications Desktop Integrator 12.2.13

Discovery Timeline

• 2024-01-16 - Oracle releases Critical Patch Update (January 2024) containing the fix
• 2024-02-17 - CVE-2024-20907 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20907

Vulnerability Analysis

Oracle Web Applications Desktop Integrator (Web ADI) allows Oracle E-Business Suite users to integrate desktop applications such as Microsoft Excel with Oracle backend data. The vulnerability resides in the File download component, which handles the delivery of generated documents and spreadsheets to end users. An attacker can craft a malicious HTTP request that an authenticated or unauthenticated victim must interact with, triggering unintended behavior in the download workflow. Because the vulnerability causes a scope change, the attack can influence components beyond Web ADI itself within the broader E-Business Suite deployment. The impact is limited to partial confidentiality and integrity loss; availability is not affected.

Root Cause

Oracle has not published detailed root cause information. The CWE classification is listed as NVD-CWE-noinfo. Based on the attack profile — network vector, no privileges required, user interaction required, and scope change — the flaw is consistent with a client-side injection or redirection weakness in the File download handler that allows attacker-controlled content to reach a victim and act in the context of a trusted application.

Attack Vector

An attacker delivers a crafted link or request targeting the Web ADI File download endpoint. When a victim with a browser session interacts with the attacker-supplied content, the download handler processes attacker-influenced input. The scope change (S:C) indicates the vulnerable component affects resources beyond its own security authority, extending impact to other Oracle E-Business Suite modules. No authentication to Web ADI is required to initiate the attack chain.

See the Oracle Security Alert January 2024 for vendor-supplied technical references.

Detection Methods for CVE-2024-20907

Indicators of Compromise

• Unexpected HTTP GET or POST requests to Web ADI File download endpoints originating from unusual referrers or external domains.
• Web ADI download responses containing scripting content, redirects, or payloads that reference domains outside the Oracle E-Business Suite environment.
• Browser-side execution of unexpected content following a Web ADI document download by an end user.

Detection Strategies

• Inspect Oracle E-Business Suite access logs for anomalous query strings and parameter values targeting Web ADI servlets.
• Deploy web application firewall rules that validate parameter values on File download requests and block external referrer chains to Web ADI endpoints.
• Correlate user-reported phishing links with Oracle application URLs to identify social-engineering campaigns targeting Web ADI users.

Monitoring Recommendations

• Enable verbose logging on Oracle HTTP Server and application tier components handling Web ADI requests.
• Monitor outbound network connections from end-user workstations immediately after Web ADI document downloads.
• Track Oracle E-Business Suite patch inventory to confirm the January 2024 Critical Patch Update is applied on all production and non-production instances.

How to Mitigate CVE-2024-20907

Immediate Actions Required

• Apply the Oracle E-Business Suite Critical Patch Update released in January 2024 to all affected Web ADI deployments running versions 12.2.3 through 12.2.13.
• Inventory all Oracle E-Business Suite environments, including development and test tiers, to ensure patch coverage.
• Brief Web ADI end users on the user-interaction requirement and the risk of clicking untrusted links that reference Oracle application URLs.

Patch Information

Oracle addressed CVE-2024-20907 in the January 2024 Critical Patch Update. Administrators should review the Oracle Security Alert January 2024 advisory and apply the Web Applications Desktop Integrator patches corresponding to their installed version in the 12.2.x branch.

Workarounds

• Restrict network access to Oracle E-Business Suite Web ADI endpoints to trusted corporate networks and VPN users where business requirements allow.
• Deploy web application firewall policies that enforce strict referrer validation on Web ADI File download URLs.
• Enable browser-level protections and email gateway filtering to reduce the chance that users interact with crafted external links targeting Web ADI.

# Example WAF rule concept to restrict Web ADI download requests to internal referrers
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /OA_HTML/BneApplicationService" \
  "phase:1,deny,status:403,\
  chain,msg:'Block external referrer to Oracle Web ADI download endpoint'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://ebs.internal.example.com"