CVE-2024-21039: Oracle CMRO Authentication Bypass Vulnerability

CVE-2024-21039 Overview

CVE-2024-21039 is a vulnerability in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, a module within the Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.13 are affected. An unauthenticated attacker with network access via HTTP can exploit the flaw, though successful exploitation requires user interaction from a victim. The scope-change characteristic indicates that attacks may impact resources beyond the vulnerable component. Successful exploitation can lead to unauthorized read, insert, update, or delete access to a subset of accessible data. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact

Unauthenticated network-based exploitation via HTTP that requires user interaction can result in unauthorized data read and modification within Oracle Complex Maintenance, Repair, and Overhaul, with impact extending to additional products through scope change.

Affected Products

• Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
• Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
• Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

• 2024-04-16 - Oracle publishes the April 2024 Critical Patch Update addressing CVE-2024-21039
• 2024-04-16 - CVE-2024-21039 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21039

Vulnerability Analysis

The flaw resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul, part of the Oracle E-Business Suite. LOV components render dynamic selection lists in E-Business Suite forms and web UIs. The vulnerability is categorized under [CWE-285] Improper Authorization. Exploitation requires an attacker to coax an authenticated user into interacting with a crafted HTTP request or link. Because the issue produces a scope change, actions executed through the vulnerable component can affect data owned by other Oracle products integrated with E-Business Suite.

Root Cause

Oracle has not published implementation-level details for the flaw. Based on the CWE-285 classification and the LOV component context, the root cause involves improper authorization checks when the LOV component processes HTTP-driven requests, allowing operations outside the user's intended privilege boundary.

Attack Vector

The attack vector is network-based over HTTP and requires no attacker authentication. However, exploitation depends on user interaction, typically a victim clicking a crafted link or submitting a crafted form, consistent with reflected injection or cross-component request abuse patterns. Once triggered, the request executes under the victim's session context, enabling unauthorized data reads and modifications to Oracle Complex Maintenance, Repair, and Overhaul data, with cascading impact to additional E-Business Suite products.

No public proof-of-concept has been published. See the Oracle Critical Patch Update April 2024 advisory for vendor technical details.

Detection Methods for CVE-2024-21039

Indicators of Compromise

• Unexpected HTTP requests to Oracle E-Business Suite LOV endpoints originating from external referrers or suspicious user agents
• Audit log entries showing unauthorized INSERT, UPDATE, or DELETE operations on Complex Maintenance, Repair, and Overhaul tables by non-privileged sessions
• Anomalous cross-module data access patterns indicating scope-change exploitation across E-Business Suite components

Detection Strategies

• Review Oracle E-Business Suite application and database audit logs for LOV-related requests that correlate with privileged data changes
• Correlate web server access logs with session identifiers to identify requests originating from phishing links or external redirectors
• Deploy web application firewall rules that inspect LOV endpoint parameters for injection or authorization bypass patterns

Monitoring Recommendations

• Enable Oracle E-Business Suite Sign-On Audit and FND audit trails on Complex Maintenance, Repair, and Overhaul tables
• Monitor HTTP traffic to /OA_HTML/ endpoints associated with LOV functionality for abnormal query parameters
• Alert on sessions that trigger scope-crossing data access between Oracle E-Business Suite modules within short time windows

How to Mitigate CVE-2024-21039

Immediate Actions Required

• Apply the Oracle April 2024 Critical Patch Update to all affected Oracle E-Business Suite 12.2.3 through 12.2.13 environments
• Inventory all internet-accessible Oracle E-Business Suite instances and prioritize patching those exposed to untrusted networks
• Educate E-Business Suite users about phishing links that could trigger the required user interaction

Patch Information

Oracle released the fix as part of the April 2024 Critical Patch Update. Refer to the Oracle Critical Patch Update April 2024 advisory for patch identifiers and installation guidance for each affected version.

Workarounds

• Restrict HTTP access to Oracle E-Business Suite interfaces to trusted networks using a reverse proxy or VPN
• Enforce strict Referer and Origin header validation at the perimeter to reduce the viability of user-interaction attacks
• Apply URL firewall rules in Oracle E-Business Suite (FND: URL Firewall) to restrict which LOV endpoints are reachable externally

# Example: restrict external access to Oracle E-Business Suite LOV endpoints via reverse proxy
location ~* ^/OA_HTML/.*LOV {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://ebs-backend;
}