CVE-2024-21041: Oracle Complex Maintenance Repair XSS Flaw

CVE-2024-21041 Overview

CVE-2024-21041 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful exploitation requires user interaction from a victim other than the attacker. Because the vulnerability produces a scope change, attacks can impact additional Oracle products beyond the vulnerable component. Successful exploitation can result in unauthorized read access to a subset of data and unauthorized create, update, or delete access to some accessible data.

Critical Impact
Attackers can execute script in a victim's authenticated session, altering data and reading confidential information across integrated Oracle E-Business Suite modules.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes the Critical Patch Update Advisory containing CVE-2024-21041
2024-04-16 - CVE-2024-21041 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21041

Vulnerability Analysis

The flaw resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV widgets render user-supplied search or selection input back into HTML responses within the E-Business Suite user interface. The component fails to correctly encode or sanitize input before it is reflected to authenticated users, allowing script injection.

Exploitation requires a victim to interact with an attacker-supplied link or crafted request. Once the victim opens the payload in an authenticated E-Business Suite session, the injected script executes in the browser under that user's session context. The scope change indicator in the CVSS vector reflects that injected script can reach and manipulate data in adjacent modules integrated with the LOV workflow.

The EPSS probability is 0.395%, placing the CVE in the 33rd percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled parameters processed by the LOV component. When the affected pages render LOV responses, attacker-controlled data is written into the HTML response context without contextual escaping, permitting HTML and JavaScript injection.

Attack Vector

An attacker crafts a malicious URL or form submission that targets a vulnerable LOV endpoint in Oracle Complex Maintenance, Repair, and Overhaul. The attacker delivers the link to an authenticated E-Business Suite user through phishing or another social channel. When the victim activates the link, the injected payload executes in the victim's browser and can perform actions such as reading page content, exfiltrating session data, or issuing requests to other E-Business Suite modules on behalf of the user.

// No public proof-of-concept code is available for CVE-2024-21041.
// Refer to the Oracle Security Alert April 2024 for vendor guidance.

Detection Methods for CVE-2024-21041

Indicators of Compromise

HTTP requests to Oracle E-Business Suite LOV endpoints containing script tags, javascript: URIs, or HTML event handlers such as onerror= and onload= in query parameters.
Reflected responses from Complex Maintenance, Repair, and Overhaul pages that include unencoded angle brackets or inline script from request parameters.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading LOV pages.

Detection Strategies

Inspect web server and application logs for LOV request parameters containing HTML markup, encoded script payloads, or long anomalous query strings.
Deploy web application firewall (WAF) signatures that flag reflected XSS patterns targeting Oracle E-Business Suite URL paths.
Correlate email gateway telemetry with subsequent user clicks on links referencing E-Business Suite hosts to identify phishing lures that abuse this flaw.

Monitoring Recommendations

Monitor authenticated E-Business Suite sessions for anomalous data modification patterns in Complex Maintenance, Repair, and Overhaul tables.
Alert on browser-side content security policy (CSP) violations reported from E-Business Suite hosts if CSP is deployed.
Track HTTP referer chains from external domains into LOV endpoints to identify externally initiated exploitation attempts.

How to Mitigate CVE-2024-21041

Immediate Actions Required

Apply the Oracle Critical Patch Update from April 2024 to all Oracle E-Business Suite environments running Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13.
Inventory internet-exposed E-Business Suite instances and prioritize patching for any tenants accessible to unauthenticated users.
Brief users on phishing links that reference internal E-Business Suite URLs, since exploitation requires user interaction.

Patch Information

Oracle addressed CVE-2024-21041 in the Oracle Critical Patch Update Advisory - April 2024. Administrators should apply the CPU patches corresponding to their Oracle E-Business Suite 12.2 release and verify the LOV component version after installation.

Workarounds

Restrict access to Oracle E-Business Suite Complex Maintenance, Repair, and Overhaul interfaces to trusted networks using network segmentation or VPN enforcement until patches are applied.
Deploy WAF rules that strip or block HTML metacharacters in query parameters sent to LOV endpoints.
Enforce a strict Content Security Policy on E-Business Suite hosts to reduce the impact of reflected script execution.

bash

# Example WAF rule concept (ModSecurity) to block reflected XSS payloads
# targeting Oracle E-Business Suite LOV endpoints
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,id:1002104,phase:2,deny,status:403,log,msg:'Potential XSS against Oracle EBS LOV'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"