CVE-2024-21044: Oracle CMRO LOV Component CSRF Vulnerability

CVE-2024-21044 Overview

CVE-2024-21044 affects the Oracle Complex Maintenance, Repair, and Overhaul (CMRO) product within Oracle E-Business Suite. The flaw resides in the List of Values (LOV) component and impacts supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful exploitation requires user interaction from a victim other than the attacker. The vulnerability carries a scope change, meaning exploitation can affect resources beyond the vulnerable component itself. Successful attacks allow unauthorized update, insert, or delete access to a subset of CMRO data, along with unauthorized read access to a subset of CMRO data. The weakness is associated with Cross-Site Request Forgery [CWE-352].

Critical Impact
Unauthenticated network attackers can trick authenticated CMRO users into performing unauthorized data modifications, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle E-Business Suite Complex Maintenance, Repair, and Overhaul 12.2.3
Oracle E-Business Suite Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle E-Business Suite Complex Maintenance, Repair, and Overhaul 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21044 published to NVD alongside the Oracle Critical Patch Update Advisory - April 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21044

Vulnerability Analysis

The vulnerability resides in the LOV (List of Values) component of Oracle Complex Maintenance, Repair, and Overhaul. LOV components are reusable UI elements in Oracle E-Business Suite that retrieve and display selectable data values for form fields. The flaw is classified as Cross-Site Request Forgery [CWE-352], indicating the LOV component accepts state-changing HTTP requests without adequately validating whether those requests originated from a legitimate user session and workflow.

An attacker crafts a malicious HTTP request and delivers it through a phishing link, malicious page, or embedded content. When an authenticated CMRO user interacts with the attacker-supplied content, the browser submits the forged request to the E-Business Suite instance using the victim's session context. The scope change indicates that the forged action can traverse trust boundaries and impact data or functionality in other Oracle E-Business Suite components accessible to the victim.

Root Cause

The root cause is missing or insufficient anti-CSRF protection on LOV request handlers in the CMRO module. Server-side handlers process incoming requests based on the session cookie without validating an unpredictable per-request token or verifying request origin. This allows cross-origin browser requests to trigger authenticated actions.

Attack Vector

The attack vector is Network over HTTP with low attack complexity and no privileges required, but user interaction is mandatory. The attacker hosts or delivers content that causes the victim's browser to issue an HTTP request to the target E-Business Suite instance. The victim must possess an active authenticated CMRO session for the forged request to execute with their privileges. Because scope is changed, actions may reach data belonging to other Oracle E-Business Suite products the victim can access.

No public exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.185%.

Detection Methods for CVE-2024-21044

Indicators of Compromise

HTTP requests to CMRO LOV endpoints with Referer or Origin headers pointing to external, non-corporate domains.
Authenticated CMRO write operations (insert, update, delete) that lack a preceding user navigation trail in application audit logs.
Unexpected modifications to CMRO records occurring immediately after a user clicked an emailed link or visited an untrusted site.

Detection Strategies

Correlate web access logs against E-Business Suite session records to flag state-changing requests without a matching in-app navigation sequence.
Alert on CMRO transactions originating from browser sessions where the Referer header is missing or points to non-Oracle E-Business Suite hosts.
Monitor Oracle E-Business Suite audit tables (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) for cross-module activity that follows LOV requests, which may indicate scope-change exploitation.

Monitoring Recommendations

Enable and centralize Oracle E-Business Suite framework audit logging and forward events to a SIEM for correlation.
Track user complaints or helpdesk tickets referencing unexpected CMRO data changes and correlate with recent phishing campaigns.
Deploy a web application firewall in front of the E-Business Suite tier and log all CMRO LOV endpoint access for retrospective review.

How to Mitigate CVE-2024-21044

Immediate Actions Required

Apply the Oracle Critical Patch Update from April 2024 to all Oracle E-Business Suite 12.2.3 through 12.2.13 environments running the CMRO module.
Inventory all CMRO deployments and verify patch level using Oracle's adop utility and patch reporting.
Notify CMRO users about phishing risk and instruct them to log out of E-Business Suite when not actively using it.

Patch Information

Oracle addressed CVE-2024-21044 in the Oracle Critical Patch Update Advisory - April 2024. Administrators should reference the Oracle Security Alert April 2024 for the specific patch identifiers applicable to each E-Business Suite 12.2.x release and apply them following Oracle's documented patching procedures.

Workarounds

Restrict CMRO responsibilities to only users with a demonstrated business need to reduce the population of viable CSRF victims.
Enforce short session timeouts on Oracle E-Business Suite to shorten the window in which forged requests can execute.
Deploy browser-side and gateway controls that block or warn on cross-site requests to E-Business Suite hostnames until patching completes.

bash

# Configuration example: shorten E-Business Suite session timeout via profile options
# Set 'ICX: Session Timeout' (minutes) at the site level to limit CSRF exposure window
# Navigate: System Administrator > Profile > System
#   Profile: ICX: Session Timeout
#   Level: Site
#   Value: 15