CVE-2024-21020: Oracle Complex Maintenance CSRF Vulnerability

CVE-2024-21020 Overview

CVE-2024-21020 is a vulnerability in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. Affected releases include versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful attacks require user interaction from a victim other than the attacker. Exploitation can result in unauthorized update, insert, or delete access to some data, and unauthorized read access to a subset of data. Because the scope changes, attacks may affect additional Oracle products beyond the vulnerable component. Oracle addressed this issue in the April 2024 Critical Patch Update.

Critical Impact
A remote, unauthenticated attacker who tricks an authenticated Oracle EBS user into visiting a crafted page can modify or read data across the CMRO module and adjacent products via scope change.

Affected Products

Oracle E-Business Suite - Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle E-Business Suite - Complex Maintenance, Repair, and Overhaul 12.2.4 through 12.2.12
Oracle E-Business Suite - Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes fix in April 2024 Critical Patch Update and CVE-2024-21020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21020

Vulnerability Analysis

CVE-2024-21020 resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul (CMRO). The classification [CWE-352] identifies the issue as Cross-Site Request Forgery. An attacker crafts a malicious request that a targeted, authenticated Oracle EBS user unwittingly submits from their browser. The application processes the forged request under the victim's session context and performs state-changing operations. Because the attack scope changes, an exploit against CMRO can affect additional Oracle E-Business Suite modules that share trust relationships with the vulnerable component. The impact covers partial confidentiality and integrity, with no direct availability impact.

Root Cause

The LOV component does not adequately verify that state-changing HTTP requests originate from a legitimate user workflow. Missing or insufficient anti-CSRF tokens allow an attacker-supplied form or link to trigger authenticated actions on behalf of the victim. This falls squarely under [CWE-352] Cross-Site Request Forgery.

Attack Vector

The attack vector is Network over HTTP and requires no privileges. It does require user interaction: a signed-in Oracle EBS user must be lured into loading attacker-controlled content, typically via phishing or a watering-hole page. Once the victim's browser sends the crafted request, the LOV endpoint accepts it and performs the resulting operation. The scope-change property allows lateral impact into related Oracle EBS components accessed under the same session.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Security Alert April 2024 for vendor technical details.

Detection Methods for CVE-2024-21020

Indicators of Compromise

Unexpected update, insert, or delete operations against CMRO LOV endpoints originating from user sessions with anomalous HTTP Referer or Origin headers.
Application audit records showing state-changing calls from users who were not actively working in the CMRO module at the recorded time.
Outbound HTTP requests from user workstations to Oracle EBS URLs immediately after visits to unknown external sites.

Detection Strategies

Inspect Oracle EBS access logs for state-changing HTTP requests to CMRO LOV URLs where the Referer header does not match an internal EBS host.
Correlate browser proxy or endpoint telemetry with EBS application logs to identify cross-site request patterns targeting authenticated sessions.
Alert on EBS transactions performed within seconds of a user opening an external email link or unfamiliar web page.

Monitoring Recommendations

Enable and centralize Oracle E-Business Suite audit logging for the Complex Maintenance, Repair, and Overhaul module.
Forward web application firewall (WAF) and reverse proxy logs to a SIEM for correlation against user email and browsing activity.
Monitor for phishing campaigns that specifically reference Oracle EBS URLs or CMRO workflows in the corporate mail gateway.

How to Mitigate CVE-2024-21020

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite 12.2.x deployments running the CMRO module.
Inventory all internet-exposed Oracle EBS instances and restrict access to trusted network segments where feasible.
Enforce user awareness training focused on phishing links that reference internal Oracle EBS applications.

Patch Information

Oracle addressed CVE-2024-21020 in the Critical Patch Update released April 16, 2024. Administrators should review the Oracle Security Alert April 2024 advisory and apply the corresponding CMRO patches for the affected 12.2.3-12.2.13 releases.

Workarounds

Place Oracle EBS behind a WAF configured to enforce strict Origin and Referer header checks on state-changing requests to CMRO endpoints.
Require users to access Oracle EBS from a dedicated browser profile or isolated workstation that does not browse the general internet.
Configure short session timeouts and re-authentication prompts for sensitive CMRO transactions to reduce the exploitation window.

bash

# Example Apache reverse proxy rule to reject cross-origin POSTs to CMRO endpoints
<LocationMatch "^/OA_HTML/.*(CMRO|AHL).*">
    SetEnvIfNoCase Origin "^https://ebs\.example\.com$" origin_ok
    <LimitExcept GET HEAD>
        Require env origin_ok
    </LimitExcept>
</LocationMatch>