CVE-2024-21072: Oracle Installed Base Auth Bypass Vulnerability

CVE-2024-21072 Overview

CVE-2024-21072 is a vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically within the Data Provider UI component. Affected versions span 12.2.3 through 12.2.13. An unauthenticated attacker with network access over HTTP can exploit the flaw, but successful exploitation requires interaction from a user other than the attacker. Because the vulnerability causes a scope change, successful attacks can affect additional products beyond Oracle Installed Base. Impact includes unauthorized update, insert, or delete access to a subset of Oracle Installed Base data, and unauthorized read access to a subset of its data.

Critical Impact
Unauthenticated attackers can leverage user interaction to achieve unauthorized read and write access to Oracle Installed Base data, with cross-component (scope change) impact across Oracle E-Business Suite.

Affected Products

Oracle E-Business Suite — Oracle Installed Base 12.2.3
Oracle E-Business Suite — Oracle Installed Base versions 12.2.4 through 12.2.12
Oracle E-Business Suite — Oracle Installed Base 12.2.13

Discovery Timeline

2024-04-16 - Oracle publishes the Critical Patch Update addressing CVE-2024-21072
2024-04-16 - CVE-2024-21072 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21072

Vulnerability Analysis

The vulnerability resides in the Data Provider UI component of Oracle Installed Base, a module of Oracle E-Business Suite used to manage installed products and asset tracking. The attack is network-based over HTTP and does not require authentication, but it requires a victim with a valid session to perform an action such as clicking a crafted link. The flaw is characterized by a scope change, meaning the impact extends beyond Oracle Installed Base to additional components within the E-Business Suite deployment. Confidentiality and integrity are partially impacted; availability is not affected. Oracle has not published a CWE classification for this issue, and NVD lists it as NVD-CWE-noinfo.

Root Cause

Oracle has not disclosed the underlying code-level root cause. The combination of required user interaction, HTTP delivery, and scope change is consistent with client-facing input handling defects in the Data Provider UI, such as cross-site scripting or related injection patterns, where attacker-controlled content is rendered or acted upon by an authenticated user's browser context. Confirmation of the precise defect class is only available through Oracle's advisory channel.

Attack Vector

An unauthenticated remote attacker crafts a malicious HTTP request or link targeting the Data Provider UI endpoint of a reachable Oracle Installed Base instance. The attacker then induces a legitimate authenticated user to interact with the payload, typically through social engineering such as a phishing email. Upon interaction, the user's privileged session performs unauthorized read, insert, update, or delete operations on Installed Base data, with effects that may propagate to adjacent E-Business Suite components. Refer to the Oracle Critical Patch Update April 2024 for authoritative technical details.

No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2024-21072

Indicators of Compromise

Unexpected HTTP requests to Oracle Installed Base Data Provider UI endpoints originating from external referrers or embedded in email-delivered links.
Unauthorized changes to Oracle Installed Base records (insert, update, or delete) correlated with user web sessions rather than batch jobs.
Audit log entries showing data modifications executed under end-user accounts without a corresponding business workflow.

Detection Strategies

Review Oracle E-Business Suite application and HTTP server logs for anomalous Data Provider UI parameter values, especially those containing script, markup, or encoded payloads.
Correlate Installed Base data modifications with web session activity to identify changes triggered by user interaction rather than scheduled processes.
Enable and monitor Oracle E-Business Suite auditing on Installed Base tables to flag out-of-pattern DML activity.

Monitoring Recommendations

Alert on inbound HTTP traffic to Oracle E-Business Suite endpoints with suspicious query strings or payload characteristics.
Monitor outbound email gateways and web proxies for links referencing Oracle E-Business Suite hostnames shared with internal users.
Track privileged user sessions interacting with the Installed Base module for deviations from established baselines.

How to Mitigate CVE-2024-21072

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update for Oracle E-Business Suite as documented in the Oracle Critical Patch Update April 2024 advisory.
Inventory all Oracle E-Business Suite deployments and identify instances running Installed Base versions 12.2.3 through 12.2.13.
Restrict network exposure of Oracle E-Business Suite web tiers to trusted internal networks or VPN-reachable segments.

Patch Information

Oracle addressed CVE-2024-21072 in the April 2024 Critical Patch Update. Administrators should review the advisory for the specific patch identifiers that apply to their Installed Base release and installation topology, and schedule deployment through Oracle's standard patching procedures. Validate patch application in a non-production environment prior to production rollout.

Workarounds

Educate users with Oracle E-Business Suite access about phishing and link-click risks targeting internal application URLs.
Deploy web application firewall rules to inspect and filter requests to Installed Base Data Provider UI endpoints for suspicious parameter content.
Enforce short web session timeouts and re-authentication requirements for sensitive E-Business Suite modules until patching is complete.

bash

# Configuration example: restrict Installed Base URL access at the reverse proxy
# (adapt the location and allowlist to your environment)
location /OA_HTML/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://ebs-backend;
}