CVE-2024-21023: Oracle Complex Maintenance Repair XSS Flaw

CVE-2024-21023 Overview

CVE-2024-21023 is a cross-site scripting (XSS) vulnerability [CWE-79] in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit this issue, but successful exploitation requires interaction from a user other than the attacker. The vulnerability has a scope change, meaning attacks can impact additional products beyond the vulnerable component. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation enables unauthorized read access to a subset of application data and unauthorized update, insert, or delete access to some accessible data, with potential cross-component impact.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21023 published to the National Vulnerability Database (NVD)
2024-04-16 - Oracle releases fix in the April 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21023

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV widgets render selectable data pulled from backend queries into HTML returned by the application. Insufficient output encoding or input sanitization in the LOV rendering path allows attacker-controlled content to be reflected or stored in a response and executed in a victim's browser session.

Because the issue triggers in the context of an authenticated Oracle E-Business Suite user, the executed script runs with that user's session privileges. The CVSS scope change indicates that script execution can reach resources beyond the vulnerable component, including other Oracle E-Business Suite modules sharing the same browser origin or session context.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Data processed by the LOV component is not consistently escaped before being emitted into HTML responses. When a crafted value reaches the rendering layer, the browser interprets attacker-supplied markup or JavaScript rather than treating it as inert text.

Attack Vector

Exploitation is network-based over HTTP and does not require prior authentication to the vulnerable endpoint. The attack requires user interaction, typically by convincing an authenticated Oracle E-Business Suite user to visit a crafted link or interact with a page that triggers the vulnerable LOV flow. Once triggered, the attacker's script runs in the victim's session, allowing session-bound actions such as reading permitted data or performing update, insert, or delete operations the victim is authorized to execute.

No verified public proof-of-concept code is available for this vulnerability. Oracle has not published exploitation details beyond the Critical Patch Update advisory.

Detection Methods for CVE-2024-21023

Indicators of Compromise

HTTP requests to Oracle E-Business Suite LOV endpoints containing script tags, event handlers (onerror=, onload=), or encoded JavaScript payloads in query parameters or form fields.
Unexpected outbound requests from user browsers after visiting Oracle E-Business Suite pages, indicating data exfiltration via injected script.
Application audit log entries showing update, insert, or delete operations performed by legitimate users at unusual times or against unexpected records.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect HTTP parameters sent to Oracle E-Business Suite LOV endpoints for XSS payload patterns.
Enable detailed HTTP access logging on the Oracle E-Business Suite application tier and alert on requests containing suspicious script-like content.
Correlate browser-side Content Security Policy (CSP) violation reports with application access logs to surface attempted script execution.

Monitoring Recommendations

Monitor Oracle E-Business Suite audit trails for anomalous data modifications performed under end-user sessions.
Track user-agent anomalies and referer headers on LOV requests to detect crafted links delivered via phishing.
Baseline normal LOV query parameters and alert on structural deviations such as embedded HTML entities or encoded script fragments.

How to Mitigate CVE-2024-21023

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all Oracle E-Business Suite environments running affected versions 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite instances, including non-production environments, and confirm patch status for the Complex Maintenance, Repair, and Overhaul module.
Educate Oracle E-Business Suite users to avoid clicking unsolicited links referencing internal application URLs.

Patch Information

Oracle addressed CVE-2024-21023 in the April 2024 Critical Patch Update. Patch details, download links, and version-specific guidance are available in the Oracle April 2024 Security Alert. Apply the patch bundle corresponding to the installed Oracle E-Business Suite release.

Workarounds

Restrict network access to Oracle E-Business Suite to trusted internal networks or VPN users only, reducing exposure to unauthenticated remote attackers.
Deploy a WAF in front of Oracle E-Business Suite with reflected and stored XSS signature enforcement on LOV endpoints.
Enforce a strict Content Security Policy on Oracle E-Business Suite responses to limit script execution sources until patching is complete.

bash

# Example WAF rule concept (ModSecurity-style) to block common XSS patterns on LOV endpoints
SecRule REQUEST_URI "@contains /OA_HTML/" \
    "id:1002024,\
     phase:2,\
     deny,\
     status:403,\
     msg:'Potential XSS targeting Oracle EBS LOV (CVE-2024-21023)',\
     chain"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"