CVE-2024-21032: Oracle CMRO CSRF Vulnerability

CVE-2024-21032 Overview

CVE-2024-21032 is a vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul (CMRO) product of Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful attacks require human interaction from a user other than the attacker. Oracle categorizes the weakness under [CWE-352] Cross-Site Request Forgery. The vulnerability produces a scope change, meaning exploitation may impact products beyond CMRO itself. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized update, insert, or delete access to CMRO data and unauthorized read access to a subset of CMRO data, with impact extending beyond the vulnerable component.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes the April 2024 Critical Patch Update advisory
2024-04-16 - CVE-2024-21032 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21032

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) issue in the LOV component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components render selection lists that back many E-Business Suite transactional forms and drive downstream data operations. When state-changing LOV requests lack proper anti-CSRF protection, an attacker-controlled page can cause an authenticated user's browser to submit forged requests to CMRO endpoints. Because the affected requests reach a privileged application session, the server processes them under the victim's identity. The scope change indicated by Oracle reflects that CMRO shares session context and integrations with other E-Business Suite modules, allowing the impact to propagate beyond the vulnerable component. The EPSS score of 0.197% suggests low observed exploitation activity to date, but the low complexity and unauthenticated network reach warrant timely remediation.

Root Cause

The root cause is missing or insufficient request-origin validation on LOV endpoints. State-changing HTTP requests are accepted without a synchronizer token, origin check, or equivalent anti-CSRF control tied to the authenticated user's session.

Attack Vector

An attacker hosts a malicious page and lures an authenticated CMRO user to visit it. The victim's browser silently issues a forged HTTP request to the CMRO LOV endpoint. The application executes the request in the victim's session, resulting in unauthorized reads and unauthorized create, update, or delete operations against CMRO-accessible data.

No verified proof-of-concept code is publicly available for CVE-2024-21032.
See the Oracle Critical Patch Update April 2024 advisory for technical details:
https://www.oracle.com/security-alerts/cpuapr2024.html

Detection Methods for CVE-2024-21032

Indicators of Compromise

HTTP requests to CMRO LOV endpoints with Referer or Origin headers pointing to external, untrusted domains.
CMRO transactional records showing unexpected create, update, or delete operations tied to user sessions during normal browsing windows.
Session activity where an authenticated CMRO user issues state-changing requests immediately after navigating to unrelated external URLs.

Detection Strategies

Inspect web-tier and reverse-proxy logs for POST requests to CMRO LOV URLs lacking expected CSRF tokens or with cross-origin Referer values.
Correlate application audit logs with browser navigation telemetry to identify state changes triggered without corresponding in-application user actions.
Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to surface anomalous access patterns against CMRO forms.

Monitoring Recommendations

Alert on E-Business Suite responsibilities associated with CMRO that perform bulk modifications outside business hours.
Track failed and successful LOV-driven transactions per user and flag statistical outliers.
Retain web-tier access logs, application audit tables, and identity provider logs for a period sufficient to support CSRF investigation.

How to Mitigate CVE-2024-21032

Immediate Actions Required

Apply the Oracle E-Business Suite April 2024 Critical Patch Update to all CMRO instances running versions 12.2.3 through 12.2.13.
Inventory internet-exposed E-Business Suite deployments and prioritize patching for those reachable from untrusted networks.
Instruct CMRO users to log out of active sessions before browsing unrelated sites and to avoid clicking untrusted links while authenticated.

Patch Information

Oracle addressed CVE-2024-21032 in the April 2024 Critical Patch Update. Administrators should follow the fix instructions in the Oracle Critical Patch Update April 2024 advisory and apply the referenced patches for the Oracle E-Business Suite 12.2 code line.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or web application firewall that enforces same-origin policy and blocks requests with untrusted Referer or Origin headers on state-changing endpoints.
Restrict CMRO access to trusted network segments or VPN users to reduce exposure until patching is complete.
Shorten application session timeouts to reduce the window in which forged requests can succeed.

bash

# Example NGINX reverse-proxy rule to block cross-origin state-changing requests to CMRO
location /OA_HTML/ {
    if ($request_method = POST) {
        set $csrf_block "1";
        if ($http_origin ~* "^https?://(ebs\.example\.com)$") {
            set $csrf_block "0";
        }
        if ($csrf_block = "1") {
            return 403;
        }
    }
    proxy_pass http://ebs_backend;
}