CVE-2024-21025: Oracle Complex Maintenance Repair Overhaul Auth Bypass

CVE-2024-21025 Overview

CVE-2024-21025 is a vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul (cMRO) product of Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit this issue, though successful exploitation requires human interaction from a user other than the attacker. The vulnerability introduces a scope change, meaning attacks can impact resources beyond the vulnerable component. Successful exploitation grants unauthorized update, insert, or delete access to a subset of cMRO data, along with unauthorized read access to additional data.

Critical Impact
Remote attackers can trick authenticated users into triggering requests that modify or disclose Oracle cMRO data across trust boundaries.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes fix in the Critical Patch Update for April 2024
2024-04-16 - CVE-2024-21025 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21025

Vulnerability Analysis

The vulnerability affects the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul, a module in Oracle E-Business Suite used to manage asset maintenance workflows. The scope change and required user interaction indicate a client-side injection pattern consistent with reflected cross-site scripting (XSS) or a similar user-assisted request forgery vector. NVD classifies the weakness as NVD-CWE-noinfo, and Oracle does not disclose the underlying code path.

An attacker crafts a malicious HTTP request or URL targeting the LOV interface. When an authenticated E-Business Suite user visits the crafted link, the injected payload executes in the victim's browser session under the E-Business Suite origin. This enables the attacker to perform actions or read data with the victim's privileges, extending the impact to additional Oracle E-Business Suite modules the victim can reach.

Root Cause

The root cause is insufficient output encoding or input validation in the LOV component. User-controlled data reaches the response context without adequate sanitization, allowing injected content to alter how the browser interprets the page. Oracle's April 2024 Critical Patch Update remediates the flaw but does not publish specific code-level details.

Attack Vector

The attack vector is network-based over HTTP and requires no prior authentication on the attacker's side. Exploitation depends on social engineering to persuade a legitimate cMRO user to click a crafted link or load attacker-controlled content. Once triggered, the injected payload executes with the victim's session context and can pivot to affect other integrated Oracle E-Business Suite components.

No verified proof-of-concept code is publicly available. Refer to the Oracle Critical Patch Update April 2024 advisory for vendor-supplied remediation details.

Detection Methods for CVE-2024-21025

Indicators of Compromise

HTTP requests to Oracle E-Business Suite LOV endpoints containing script tags, encoded JavaScript payloads, or unusual character sequences in query parameters.
Web server or application logs showing referrers from untrusted external domains preceding sensitive cMRO transactions.
Unexpected data modifications (insert, update, delete) in cMRO tables performed under legitimate user sessions shortly after external link clicks.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to Oracle E-Business Suite URLs for XSS payload patterns targeting LOV parameters.
Correlate authentication events with anomalous outbound HTTP referrers to identify users who arrived at cMRO from suspicious external sources.
Audit Oracle E-Business Suite session activity for privilege actions that occur immediately after redirect-based navigation events.

Monitoring Recommendations

Enable verbose access logging on Oracle HTTP Server fronting E-Business Suite and forward logs to a centralized analytics platform for retention and query.
Monitor Oracle FND audit trails for unexpected data changes in cMRO objects and alert on activity outside business hours or normal user patterns.
Track browser telemetry and email gateway logs for links pointing to internal Oracle E-Business Suite hosts originating from external senders.

How to Mitigate CVE-2024-21025

Immediate Actions Required

Apply the Oracle Critical Patch Update for April 2024 to all Oracle E-Business Suite 12.2.3 through 12.2.13 installations running the Complex Maintenance, Repair, and Overhaul module.
Inventory environments to confirm which E-Business Suite instances have the cMRO product licensed and enabled, prioritizing internet-exposed systems.
Notify cMRO users to avoid clicking untrusted links that reference E-Business Suite URLs until patching completes.

Patch Information

Oracle addressed CVE-2024-21025 in the April 2024 Critical Patch Update. Administrators should download and apply the appropriate patch bundle from the Oracle Critical Patch Update April 2024 advisory. Patch application requires standard Oracle E-Business Suite maintenance procedures, including pre-patch backups and post-patch validation of cMRO functionality.

Workarounds

Restrict network access to Oracle E-Business Suite LOV endpoints using a reverse proxy or WAF that filters suspicious query parameters.
Enforce strict Content Security Policy (CSP) headers on Oracle E-Business Suite responses to limit inline script execution where compatible with the application.
Configure browser isolation or email link rewriting for users with cMRO access to reduce the likelihood of successful user-interaction attacks.

bash

# Example WAF rule (ModSecurity) blocking XSS patterns in LOV requests
SecRule REQUEST_URI "@contains /OA_HTML/" \
    "chain,phase:2,deny,status:403,id:1002024021025,\
    msg:'Potential CVE-2024-21025 XSS attempt against Oracle cMRO LOV'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"