CVE-2024-21046: Oracle CMRO LOV Component XSS Vulnerability

CVE-2024-21046 Overview

CVE-2024-21046 is a cross-site scripting (XSS) vulnerability in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue, but successful exploitation requires user interaction from a victim other than the attacker. Because the vulnerability produces a scope change, exploitation can affect resources beyond the vulnerable component. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Successful exploitation allows unauthorized read, insert, update, or delete access to a subset of Oracle Complex Maintenance, Repair, and Overhaul data, and may impact additional Oracle E-Business Suite products due to scope change.

Affected Products

Oracle Complex Maintenance, Repair, and Overhaul version 12.2.3
Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.4 through 12.2.12
Oracle Complex Maintenance, Repair, and Overhaul version 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes CVE-2024-21046 as part of the April 2024 Critical Patch Update
2024-04-16 - CVE-2024-21046 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21046

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79], commonly known as cross-site scripting (XSS). It resides in the List of Values (LOV) component of Oracle Complex Maintenance, Repair, and Overhaul within Oracle E-Business Suite. The LOV component provides selectable value pickers used across multiple E-Business Suite forms and workflows.

Because the flaw triggers a scope change, injected content can influence resources managed outside the vulnerable module. Attackers can leverage this to affect confidentiality and integrity of data accessible through the victim's authenticated session. Availability is not impacted. Exploitation requires the victim to interact with attacker-controlled content, typically by clicking a crafted link or loading a malicious page while authenticated to E-Business Suite.

Root Cause

The root cause is insufficient output encoding or input sanitization within the LOV component. User-controllable input reaches the rendered HTML response without being neutralized, allowing script content to execute in the context of the victim's browser session.

Attack Vector

Exploitation occurs over the network via HTTP. An unauthenticated attacker crafts a request or link containing malicious script payloads directed at the vulnerable LOV endpoint. When an authenticated E-Business Suite user interacts with the attacker's content, the payload executes in the user's browser under the application origin. The attacker can then read or modify data the victim is authorized to access, or pivot to additional E-Business Suite modules exposed by the scope change.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the Oracle Critical Patch Update April 2024 advisory for technical remediation details.

Detection Methods for CVE-2024-21046

Indicators of Compromise

HTTP requests to Oracle E-Business Suite LOV endpoints containing script tags, event handlers such as onerror= or onload=, or encoded JavaScript payloads.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from the E-Business Suite application origin.
Session activity showing unauthorized data reads, inserts, updates, or deletions in Complex Maintenance, Repair, and Overhaul tables tied to a legitimate user session.

Detection Strategies

Inspect web server and reverse proxy logs for anomalous query parameters and POST bodies targeting LOV components in E-Business Suite URLs.
Deploy web application firewall (WAF) rules that flag reflected XSS patterns in requests to E-Business Suite endpoints.
Correlate authenticated user activity with browser-side telemetry to identify script execution originating from LOV-generated pages.

Monitoring Recommendations

Enable verbose logging on the Oracle HTTP Server fronting E-Business Suite and forward logs to a centralized SIEM for pattern analysis.
Monitor for phishing campaigns delivering crafted URLs that reference internal E-Business Suite hostnames or LOV endpoints.
Track application audit logs for data modifications in Complex Maintenance, Repair, and Overhaul tables that do not match expected user workflows.

How to Mitigate CVE-2024-21046

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all affected instances running versions 12.2.3 through 12.2.13.
Inventory all Oracle E-Business Suite deployments and confirm Complex Maintenance, Repair, and Overhaul module status.
Alert users to the risk of phishing links that direct them to authenticated E-Business Suite URLs from external sources.

Patch Information

Oracle released the fix as part of the Oracle Critical Patch Update April 2024. Administrators should follow Oracle's E-Business Suite patching procedures to apply the relevant patch level for their environment. Verify patch application by reviewing the AD_BUGS table and Oracle Configuration Manager reports after installation.

Workarounds

Restrict access to the E-Business Suite application to trusted networks or VPN-only paths where feasible until patching completes.
Configure a reverse proxy or WAF to filter suspicious script content in requests targeting LOV endpoints.
Enforce Content Security Policy (CSP) headers on the E-Business Suite web tier to constrain inline script execution.
Train users to avoid clicking untrusted links that reference internal application hostnames.

bash

# Example WAF rule pattern (ModSecurity syntax) to block common XSS payloads
# targeting Oracle E-Business Suite LOV endpoints
SecRule REQUEST_URI "@rx /OA_HTML/.*LOV" \
    "chain,id:1002104,phase:2,deny,status:403,\
    msg:'Potential XSS targeting EBS LOV component (CVE-2024-21046)'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"