CVE-2024-21036: Oracle CMRO LOV Component XSS Vulnerability

CVE-2024-21036 Overview

CVE-2024-21036 is a cross-site scripting (XSS) vulnerability [CWE-79] in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the issue, but successful attacks require interaction from a user other than the attacker. The vulnerability has a scope change, meaning exploitation can affect resources beyond the vulnerable component. Oracle addressed the flaw in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation enables unauthorized read, insert, update, or delete access to a subset of data in Oracle Complex Maintenance, Repair, and Overhaul and may impact adjacent products through scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21036 published to NVD alongside the Oracle Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21036

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV controls render selectable value pickers in Oracle E-Business Suite forms and pages. The component fails to properly neutralize user-supplied input before it is reflected in web pages, which maps to the CWE-79 Cross-Site Scripting weakness class.

An unauthenticated attacker can craft a malicious HTTP request or URL containing script payloads. When a legitimate user, often an authenticated maintenance operator or administrator, interacts with the attacker-controlled content, the script executes within the user's browser session. Because the vulnerability carries a scope change, the executed script can act on behalf of the victim against additional Oracle E-Business Suite modules reachable from the same session.

Root Cause

The root cause is improper neutralization of input during web page generation within the LOV component. User-controlled parameters are embedded into the rendered HTML or JavaScript context without sufficient output encoding or sanitization, allowing injected markup to be parsed and executed by the victim's browser.

Attack Vector

Exploitation occurs over the network via HTTP and requires no attacker authentication. The attacker constructs a URL or form submission containing a script payload targeting a vulnerable LOV endpoint. The attack succeeds only when a victim user interacts with the crafted link, typically through phishing or a trusted-looking internal reference. Resulting payloads can steal session cookies, perform actions as the victim, exfiltrate form data, or pivot into other E-Business Suite components covered by the user's privileges.

No verified public proof-of-concept code is available. See the Oracle Security Advisory April 2024 for vendor technical details.

Detection Methods for CVE-2024-21036

Indicators of Compromise

HTTP requests to Oracle E-Business Suite LOV endpoints containing script tags, javascript: URIs, event handlers such as onerror= or onload=, or encoded variants in query parameters.
Web server access logs showing unusually long query strings or payloads with HTML entities targeting Complex Maintenance, Repair, and Overhaul URLs.
Browser or endpoint telemetry showing unexpected outbound requests from Oracle EBS session contexts to attacker-controlled domains.

Detection Strategies

Deploy a web application firewall with signatures tuned for reflected XSS patterns against Oracle E-Business Suite URL paths.
Review Oracle EBS application and web tier logs for anomalous GET or POST requests to LOV handlers with suspicious parameter content.
Correlate user session activity with outbound DNS or HTTP connections to unknown domains originating from EBS user workstations.

Monitoring Recommendations

Enable verbose HTTP logging on Oracle HTTP Server fronting E-Business Suite and forward logs to a central analytics platform.
Monitor for repeated requests to the same LOV endpoint from different source IPs, which may indicate reconnaissance or payload tuning.
Alert on EBS user sessions that generate browser-side errors or redirects immediately after clicking email or chat links.

How to Mitigate CVE-2024-21036

Immediate Actions Required

Apply the Oracle April 2024 Critical Patch Update to all Oracle E-Business Suite environments running Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13.
Inventory internet-exposed Oracle EBS instances and prioritize patching those reachable from untrusted networks.
Notify EBS users of the risk of clicking unsolicited links referencing EBS URLs until patching is complete.

Patch Information

Oracle released fixes for CVE-2024-21036 in the April 2024 Critical Patch Update. Administrators should consult the Oracle Security Advisory April 2024 and apply the patches corresponding to each deployed E-Business Suite release level. Oracle recommends staying on actively supported versions and applying Critical Patch Updates on the quarterly cadence.

Workarounds

Restrict access to Oracle E-Business Suite behind a VPN or zero-trust access gateway to reduce exposure to unauthenticated attackers.
Configure a web application firewall rule set that blocks requests to LOV endpoints containing script tags, event handler attributes, or encoded XSS payloads.
Enforce a strict Content Security Policy and HttpOnly, Secure, and SameSite cookie attributes to limit script execution and session theft.
Train EBS users to validate the source of internal links before clicking and to report unexpected browser behavior.

bash

# Example WAF rule concept blocking reflected XSS patterns on EBS LOV paths
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,id:1002136,phase:2,deny,status:403,msg:'Potential XSS targeting Oracle EBS LOV'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"