CVE-2024-21043: Oracle CMRO CSRF Vulnerability

CVE-2024-21043 Overview

CVE-2024-21043 is a Cross-Site Request Forgery [CWE-352] vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul (CMRO) product, part of Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue when a legitimate user is tricked into interacting with attacker-controlled content. Successful exploitation yields unauthorized read, insert, update, or delete access to a subset of CMRO data. The attack crosses a security scope, meaning impact can extend to additional Oracle E-Business Suite components beyond CMRO itself.

Critical Impact
Successful exploitation permits unauthorized modification and disclosure of Oracle CMRO data and can affect adjacent Oracle E-Business Suite products through scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21043 published to the National Vulnerability Database
2024-04-16 - Oracle publishes fix in the Critical Patch Update - April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21043

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the LOV component of Oracle CMRO. The application does not sufficiently verify that state-changing HTTP requests originate from authenticated sessions initiated within the application. An attacker crafts a malicious page or link that, when visited by an authenticated CMRO user, triggers unauthorized actions under the victim's session context. Because the CVSS vector indicates a scope change, the trust boundary crossed by exploitation extends beyond the CMRO module. Impacts include unauthorized read of a subset of CMRO data and unauthorized insert, update, or delete operations against records the victim can access.

Root Cause

The root cause is missing or insufficient anti-CSRF protection on state-changing endpoints exposed through the LOV component. Oracle E-Business Suite requests processed through the affected LOV logic accept forged cross-origin requests when a browser automatically attaches session cookies to the outbound HTTP call. Without a validated per-session token, origin check, or equivalent server-side control, the server cannot distinguish an intentional user action from a forged one.

Attack Vector

Exploitation requires network access via HTTP and human interaction from a user other than the attacker. A typical attack chain begins with a phishing message, malvertising link, or watering-hole page containing crafted HTML or JavaScript. When an authenticated CMRO user opens the attacker's content in the same browser, the browser issues a forged HTTP request to the vulnerable LOV endpoint. The Oracle E-Business Suite server processes the request in the victim's authenticated context and performs data reads or writes on the attacker's behalf. Attacker authentication is not required, but the victim must hold an active CMRO session.

No public proof-of-concept code is available for this vulnerability. See the Oracle Critical Patch Update April 2024 advisory for vendor-supplied technical detail.

Detection Methods for CVE-2024-21043

Indicators of Compromise

Unexpected insert, update, or delete operations in CMRO tables correlated with recent user web sessions.
Inbound HTTP requests to LOV endpoints with Referer or Origin headers pointing to external, non-Oracle E-Business Suite domains.
Session activity where a state-changing CMRO request follows immediately after the user navigated from an external URL.
Application audit log entries showing writes performed outside typical user workflow patterns.

Detection Strategies

Inspect Oracle E-Business Suite access logs for LOV component requests with mismatched or missing Origin and Referer headers.
Correlate authenticated CMRO write operations with prior HTTP referrers to identify cross-origin triggers.
Baseline normal LOV request patterns per user and alert on deviations such as write requests from atypical navigation paths.
Ingest Oracle E-Business Suite logs into a centralized analytics platform and hunt for anomalous CMRO transactions.

Monitoring Recommendations

Forward web tier and application audit logs from Oracle E-Business Suite to a SIEM for continuous monitoring.
Alert on any successful CMRO write initiated by a request lacking a valid same-origin Referer.
Monitor endpoint browsers of privileged CMRO users for phishing artifacts and suspicious redirects.
Track failed and successful LOV requests per session to spot automated forgery patterns.

How to Mitigate CVE-2024-21043

Immediate Actions Required

Apply the Oracle Critical Patch Update - April 2024 to all Oracle E-Business Suite environments running CMRO 12.2.3 through 12.2.13.
Instruct privileged CMRO users to log out of Oracle E-Business Suite before browsing untrusted content in the same browser.
Review recent CMRO audit records for unauthorized inserts, updates, or deletes that predate patching.
Restrict CMRO access to trusted network segments where feasible until patches are deployed.

Patch Information

Oracle addressed CVE-2024-21043 in the Oracle Critical Patch Update April 2024. Administrators should identify their exact E-Business Suite release, apply the corresponding CPU patch for Oracle Complex Maintenance, Repair, and Overhaul, and validate the fix in a non-production environment before promoting to production.

Workarounds

Enforce short session timeouts on Oracle E-Business Suite to reduce the exploitation window.
Deploy a web application firewall rule to reject state-changing CMRO requests missing a same-origin Referer or Origin header.
Segment administrative access to CMRO through a dedicated browser profile or jump host used only for Oracle E-Business Suite.
Provide user awareness training focused on phishing, since exploitation requires user interaction.

bash

# Example WAF rule concept - reject cross-origin state-changing requests to CMRO LOV endpoints
# Adapt syntax to your WAF vendor (ModSecurity example shown)
SecRule REQUEST_METHOD "@rx ^(POST|PUT|DELETE)$" \
  "chain,phase:1,deny,status:403,id:1002143,\
   msg:'CVE-2024-21043 - blocked cross-origin request to Oracle CMRO LOV'"
  SecRule REQUEST_URI "@contains /OA_HTML/" \
    "chain"
    SecRule &REQUEST_HEADERS:Origin "@eq 0" \
      "chain"
      SecRule REQUEST_HEADERS:Referer "!@beginsWith https://ebs.internal.example.com/"