CVE-2024-21022: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21022 Overview

CVE-2024-21022 affects the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, a module within Oracle E-Business Suite. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application when a legitimate user interacts with attacker-supplied content. Successful exploitation permits unauthorized modification and limited read access to application data. The scope changes during exploitation, meaning impact can extend to components beyond the vulnerable module. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can trick authenticated users into triggering requests that alter or disclose Oracle Complex Maintenance, Repair, and Overhaul data, with impact extending across trust boundaries due to scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3 through 12.2.13
Oracle E-Business Suite (LOV component)
Oracle E-Business Suite deployments exposing the affected module over HTTP

Discovery Timeline

2024-04-16 - CVE-2024-21022 published to NVD
2024-04-16 - Oracle releases fix in the April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21022

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV controls provide selectable value pickers within E-Business Suite forms and are rendered through HTTP-facing servlets. An unauthenticated attacker can craft a request or link that, when acted upon by an authenticated user, triggers unauthorized data operations within the target application.

The CVSS vector indicates user interaction is required and that the attack causes a scope change. Scope change means the compromise crosses the security boundary of the vulnerable component and can affect additional Oracle products integrated with the same E-Business Suite deployment. Impact includes unauthorized insert, update, or delete operations on a subset of accessible data along with limited unauthorized read access.

NVD classifies the underlying weakness as [NVD-CWE-noinfo] because Oracle does not publish exploit specifics. The requirement for victim interaction and the network attack surface are consistent with cross-site request forgery or reflected client-side injection patterns commonly observed in web-facing LOV handlers.

Root Cause

Oracle has not disclosed the root cause. Based on the CVSS metrics and the LOV component's role, the flaw involves insufficient validation of untrusted input processed on behalf of an authenticated session, combined with missing anti-forgery or origin controls in the affected servlet path.

Attack Vector

The attacker delivers a crafted URL or web content to a user with an active E-Business Suite session. When the victim interacts with the payload, their browser issues a request to the vulnerable LOV endpoint. The application executes the requested operation under the victim's identity, resulting in data modification or limited disclosure. No credentials or prior access to the E-Business Suite environment are required by the attacker.

See the Oracle Critical Patch Update April 2024 advisory for vendor-supplied details.

Detection Methods for CVE-2024-21022

Indicators of Compromise

Unexpected HTTP requests to LOV servlet paths within Oracle E-Business Suite originating from external referrers or unusual user agents
Authenticated user sessions performing insert, update, or delete operations against Complex Maintenance, Repair, and Overhaul records outside normal business workflows
Database audit records showing DML changes to CMRO tables shortly after user clicks on external links or email content

Detection Strategies

Enable Oracle E-Business Suite framework logging and correlate LOV requests with the session's originating referrer header
Review Oracle database fine-grained auditing (FGA) on CMRO schema objects for anomalous write patterns
Alert on HTTP requests to E-Business Suite endpoints that lack expected session tokens, CSRF tokens, or trusted referrer values

Monitoring Recommendations

Ingest Oracle E-Business Suite web tier and database audit logs into a centralized SIEM for correlation with user session context
Baseline normal LOV usage per role and generate alerts on statistical deviations in request volume or targeted tables
Monitor outbound proxy and email gateway telemetry for links pointing to E-Business Suite hosts, which can indicate phishing attempts staging this attack

How to Mitigate CVE-2024-21022

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13
Inventory all internet-exposed E-Business Suite instances and prioritize patching of externally reachable systems first
Enforce user awareness measures to reduce the likelihood that authenticated users will interact with attacker-supplied links

Patch Information

Oracle released the fix as part of the April 2024 Critical Patch Update. Administrators must apply the CMRO patch specified in the advisory to affected E-Business Suite 12.2 environments. Consult the Oracle Critical Patch Update April 2024 advisory for the exact patch identifiers, prerequisites, and post-installation validation steps.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers using firewall rules, VPN gating, or reverse proxy allowlists
Enforce strict referrer and origin header validation at a web application firewall (WAF) in front of E-Business Suite
Require re-authentication or step-up authentication for sensitive CMRO operations until patching is complete
Terminate long-lived authenticated sessions and shorten session timeout values on E-Business Suite instances

bash

# Example WAF rule concept: block cross-origin POSTs to LOV endpoints
# Adapt syntax to your WAF platform (ModSecurity example)
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,deny,status:403,id:1002401,msg:'Block cross-origin request to EBS LOV endpoint'"
  SecRule REQUEST_METHOD "@streq POST" \
    "chain"
    SecRule REQUEST_HEADERS:Origin "!@rx ^https?://ebs\.internal\.example\.com$"