CVE-2024-21021: Oracle Complex Maintenance Repair XSS Flaw

CVE-2024-21021 Overview

CVE-2024-21021 is a cross-site scripting (XSS) vulnerability [CWE-79] in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. Affected releases span versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful attacks require interaction from a user other than the attacker. Because the vulnerability produces a scope change, exploitation can affect resources beyond the vulnerable component. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation permits unauthorized read, insert, update, and delete access to a subset of Oracle Complex Maintenance, Repair, and Overhaul data, with impact extending to additional products through scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21021 published to NVD alongside the Oracle Critical Patch Update April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21021

Vulnerability Analysis

The flaw resides in the LOV (List of Values) component used by Oracle Complex Maintenance, Repair, and Overhaul. LOV widgets present selectable option lists inside E-Business Suite forms and typically render user-influenced text. Improper output encoding in this component allows attacker-controlled input to be reflected as executable script in a victim's browser session.

Because the vulnerability requires user interaction, exploitation typically follows a social-engineering vector such as a crafted URL or embedded form parameter delivered to an authenticated E-Business Suite user. When the target opens the malicious link, the injected payload executes within the trusted E-Business Suite origin, inheriting the user's session context. The scope change indicates the injected script can influence other integrated Oracle E-Business Suite modules accessible to the victim, not just the vulnerable component.

The EPSS probability for this CVE is 0.395%, reflecting current observed exploitation likelihood.

Root Cause

The root cause is missing or insufficient neutralization of input during web page generation in the LOV rendering path [CWE-79]. Server-side code returns attacker-supplied values into HTML responses without proper contextual encoding, allowing script content to survive to the browser and execute in the E-Business Suite security context.

Attack Vector

Exploitation requires network-based HTTP access to the E-Business Suite deployment and interaction from a user other than the attacker. A typical chain involves the attacker crafting a URL or form submission carrying a script payload targeting an LOV parameter, then delivering that link to an authenticated user via email, chat, or a compromised page. Upon activation, the payload runs in the victim's browser under the E-Business Suite origin and can perform unauthorized data reads or modifications the victim is entitled to make.

No public proof-of-concept exploit is available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-21021

Indicators of Compromise

HTTP request logs containing script tags, event handlers such as onerror= or onload=, or encoded JavaScript payloads in LOV-related query parameters
Unusual outbound HTTP requests originating from user browsers to attacker-controlled hosts following E-Business Suite session activity
Unexpected INSERT, UPDATE, or DELETE database operations executed under legitimate user contexts targeting Complex Maintenance, Repair, and Overhaul tables

Detection Strategies

Inspect web server and reverse proxy access logs for E-Business Suite LOV endpoints containing suspicious characters such as <, >, %3C, %3E, or javascript: schemes
Deploy a Web Application Firewall (WAF) with reflected XSS signatures tuned for Oracle E-Business Suite URL patterns
Correlate browser-based telemetry with E-Business Suite audit logs to identify script-driven actions performed outside normal user workflows

Monitoring Recommendations

Enable Oracle E-Business Suite audit trails on Complex Maintenance, Repair, and Overhaul modules to record data modifications tied to user sessions
Forward web tier and application logs to a centralized analytics platform for anomaly detection on parameter values and referrer chains
Alert on E-Business Suite users generating atypical volumes of LOV requests or requests referencing external domains

How to Mitigate CVE-2024-21021

Immediate Actions Required

Apply the Oracle Critical Patch Update from April 2024 to all Oracle E-Business Suite 12.2.x environments running Complex Maintenance, Repair, and Overhaul
Inventory internet-exposed E-Business Suite instances and prioritize patching or fronting them with a WAF until fixes are deployed
Notify E-Business Suite users of the social-engineering risk and reinforce guidance against clicking untrusted links referencing internal application URLs

Patch Information

Oracle released fixes for CVE-2024-21021 as part of the Critical Patch Update for April 2024. Refer to the Oracle Critical Patch Update April 2024 advisory for the specific patch identifiers and installation prerequisites for supported releases 12.2.3 through 12.2.13.

Workarounds

Restrict access to Oracle E-Business Suite to trusted networks or VPN clients to reduce exposure to unauthenticated attackers
Deploy WAF rules that block or sanitize HTML metacharacters and script-related keywords in LOV request parameters
Enforce browser-side protections such as a strict Content Security Policy (CSP) header on E-Business Suite responses to limit inline script execution

bash

# Example WAF rule fragment blocking script content in LOV parameters (ModSecurity syntax)
SecRule ARGS_NAMES "@rx (?i)lov" \
  "chain,id:1002101,phase:2,deny,status:403,msg:'Potential XSS in EBS LOV parameter'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"