CVE-2024-21065: Oracle PeopleSoft PeopleTools Auth Bypass

CVE-2024-21065 Overview

CVE-2024-21065 affects the Workflow component of Oracle PeopleSoft Enterprise PeopleTools. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application when a user is tricked into interacting with malicious content. Successful exploitation results in unauthorized read, insert, update, or delete access to a subset of PeopleTools data. Because the vulnerability produces a scope change, attacks may impact additional products beyond PeopleTools itself. Oracle addressed the issue in the April 2024 Critical Patch Update. The weakness is categorized under [CWE-601] (URL Redirection to Untrusted Site).

Critical Impact
Remote, unauthenticated attackers can leverage user interaction to alter or expose PeopleSoft data with cross-product impact.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.59
Oracle PeopleSoft Enterprise PeopleTools 8.60
Oracle PeopleSoft Enterprise PeopleTools 8.61

Discovery Timeline

2024-04-16 - Oracle publishes the April 2024 Critical Patch Update addressing CVE-2024-21065
2024-04-16 - CVE-2024-21065 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21065

Vulnerability Analysis

The vulnerability resides in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools. It maps to [CWE-601], an open redirect weakness in which the application accepts untrusted input used to construct a redirection target. An unauthenticated remote attacker can craft a malicious HTTP request that, once interacted with by a legitimate user, causes attacker-controlled behavior within the trusted PeopleSoft context.

Successful exploitation yields limited confidentiality and integrity impact against PeopleTools data. The scope change indicates that the security consequences extend beyond the vulnerable component into additional products or trust boundaries reachable through Workflow-driven redirects. Availability is not impacted.

Root Cause

The root cause is improper validation of a destination URL or redirect parameter processed by the Workflow component. Because the application does not restrict the redirection target to an allow-list of trusted destinations, an attacker can supply an arbitrary URL. When rendered in the context of a PeopleTools workflow link or notification, the URL appears legitimate to the end user.

Attack Vector

Exploitation requires network access to the PeopleTools HTTP interface and human interaction from a user other than the attacker. An attacker distributes a crafted URL containing a malicious redirect parameter through email, chat, or workflow notifications. When the victim clicks the link, the PeopleSoft server redirects the browser to an attacker-controlled destination, enabling phishing, credential harvesting, or delivery of second-stage payloads that ultimately modify or read PeopleTools data.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 0.34%. Refer to the Oracle Critical Patch Update April 2024 advisory for component-level technical details.

Detection Methods for CVE-2024-21065

Indicators of Compromise

HTTP requests to PeopleTools Workflow endpoints containing external URLs in redirect, return, or destination parameters.
Web server access logs showing PeopleSoft-hosted links immediately followed by outbound navigation to unfamiliar domains.
Phishing reports from end users referencing PeopleSoft-branded emails or workflow notifications with unusual link targets.

Detection Strategies

Inspect PeopleTools application and web server logs for query-string parameters whose values contain fully qualified URLs pointing outside the organization's approved domains.
Correlate workflow notification generation events with subsequent redirect responses to identify anomalous destination patterns.
Deploy web application firewall rules that flag HTTP responses with Location headers pointing to domains not on an allow-list when the request targets PeopleTools URIs.

Monitoring Recommendations

Enable verbose logging on PeopleSoft web servers to capture full request URIs and referrer chains for Workflow endpoints.
Forward PeopleTools web tier logs to a centralized analytics platform for correlation with proxy, DNS, and endpoint telemetry.
Monitor user-reported phishing submissions for links referencing internal PeopleSoft hostnames combined with external redirect targets.

How to Mitigate CVE-2024-21065

Immediate Actions Required

Apply the April 2024 Critical Patch Update from Oracle to PeopleTools 8.59, 8.60, and 8.61 deployments as documented in the vendor advisory.
Inventory internet-facing PeopleSoft Enterprise PeopleTools instances and prioritize those exposed to untrusted users for immediate patching.
Notify end users of the risk of clicking unexpected PeopleSoft workflow links until patching is complete.

Patch Information

Oracle released fixes for CVE-2024-21065 in the Oracle Critical Patch Update April 2024. Administrators must upgrade to the PeopleTools patch level identified in the advisory for each affected release train (8.59, 8.60, 8.61). Verify installation through the PeopleTools patch inventory after deployment.

Workarounds

Restrict access to PeopleTools Workflow URLs behind a reverse proxy or VPN to limit exposure to unauthenticated internet users.
Configure web application firewall rules to strip or validate redirect parameters on Workflow endpoints against an allow-list of trusted destinations.
Deliver targeted phishing awareness reminders that describe the specific risk of unexpected redirect links from PeopleSoft.

bash

# Example WAF rule pattern to flag external redirect targets on PeopleTools endpoints
# Replace <trusted-domain> with your organization's approved domains
SecRule REQUEST_URI "@rx /psp/|/psc/" \
  "chain,phase:2,deny,status:403,id:1002024,log,msg:'Potential CVE-2024-21065 open redirect'"
  SecRule ARGS "@rx ^https?://(?!<trusted-domain>)" "t:none,t:lowercase"