CVE-2024-21033: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21033 Overview

CVE-2024-21033 affects the List of Values (LOV) component in Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.13 are affected. An unauthenticated attacker with network access via HTTP can exploit this weakness, but successful attacks require human interaction from a user other than the attacker. The vulnerability produces a scope change, meaning exploitation can impact resources beyond the vulnerable component. Successful attacks yield unauthorized create, update, or delete access to some data and unauthorized read access to a subset of accessible data.

Critical Impact
Remote attackers can trick authenticated users into triggering requests that modify or disclose data within Oracle Complex Maintenance, Repair, and Overhaul and potentially other Oracle E-Business Suite modules.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes the April 2024 Critical Patch Update addressing this issue
2024-04-16 - CVE-2024-21033 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21033

Vulnerability Analysis

The flaw resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV widgets are shared UI elements across Oracle E-Business Suite that render selectable data drawn from backend queries. The vulnerability allows a remote, unauthenticated attacker to craft input that another authenticated user is coerced into processing over HTTP. Because the vulnerability produces a scope change, exploitation can affect components outside the vulnerable module, extending impact to other Oracle E-Business Suite modules that share LOV data flows. Impact is limited to partial confidentiality and integrity loss; availability is not affected.

Root Cause

Oracle has not disclosed the specific defect class, and NVD assigns [NVD-CWE-noinfo]. Based on the requirement for user interaction and the scope change, the issue is consistent with insufficient validation or output handling in LOV request processing, where attacker-controlled parameters influence actions performed in the victim's authenticated session.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker crafts a malicious link or content and delivers it through phishing, forums, or other social channels. When a signed-in Oracle E-Business Suite user interacts with the payload, the application processes attacker-influenced LOV input under that user's privileges, resulting in unauthorized read, insert, update, or delete operations.

No public proof-of-concept code has been released, and no verified exploit samples are available. See the Oracle April 2024 Security Alert for vendor-provided technical guidance.

Detection Methods for CVE-2024-21033

Indicators of Compromise

Unusual HTTP requests to LOV endpoints under OA_HTML/ containing unexpected parameters or embedded scripting content.
Authenticated Oracle E-Business Suite sessions performing insert, update, or delete operations on Complex Maintenance, Repair, and Overhaul tables outside normal business workflows.
Referrer headers on E-Business Suite requests originating from untrusted external domains.

Detection Strategies

Inspect Oracle HTTP Server (OHS) access logs for anomalous query strings targeting LOV components and correlate with user session identifiers.
Deploy web application firewall rules that detect suspicious payloads in LOV parameter values.
Baseline user behavior for Complex Maintenance, Repair, and Overhaul modules and alert on deviations in data modification patterns.

Monitoring Recommendations

Forward Oracle E-Business Suite application and web tier logs to a centralized analytics platform for correlation with endpoint and identity telemetry.
Enable auditing on Complex Maintenance, Repair, and Overhaul database tables for INSERT, UPDATE, and DELETE actions performed through interactive sessions.
Monitor outbound email and browser telemetry for phishing lures that reference Oracle E-Business Suite URLs.

How to Mitigate CVE-2024-21033

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update for Oracle E-Business Suite 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite deployments and confirm the Complex Maintenance, Repair, and Overhaul module version.
Communicate phishing awareness guidance to users with active Oracle E-Business Suite sessions.

Patch Information

Oracle addressed CVE-2024-21033 in the April 2024 Critical Patch Update. Administrators should review the Oracle April 2024 Security Alert for patch identifiers, prerequisites, and installation procedures specific to Oracle E-Business Suite 12.2.x.

Workarounds

Restrict access to Oracle E-Business Suite web tiers to trusted networks or VPN-authenticated users where feasible.
Enforce short session timeouts and re-authentication for privileged Complex Maintenance, Repair, and Overhaul functions.
Deploy web application firewall policies that filter suspicious LOV request parameters until patching completes.

bash

# Example: WAF rule concept to block LOV requests containing script payloads
# (Adapt to your WAF's rule syntax before deployment)
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,phase:2,deny,status:403,id:1002133,\
  msg:'Suspicious Oracle EBS LOV request - CVE-2024-21033'"
  SecRule ARGS "@rx (?i)(<script|onerror=|javascript:)" "t:none,t:urlDecodeUni"