CVE-2024-21076: Oracle Trade Management Auth Bypass Flaw

CVE-2024-21076 Overview

CVE-2024-21076 is an access control vulnerability [CWE-284] in the Offer LOV component of Oracle Trade Management, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.13. An unauthenticated attacker with network access via HTTP can exploit the issue to compromise Oracle Trade Management. Successful exploitation results in unauthorized read access to all data accessible through Oracle Trade Management. Oracle addressed the issue in the April 2024 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can obtain unauthorized access to critical or all Oracle Trade Management data over HTTP without user interaction.

Affected Products

Oracle Trade Management 12.2.3
Oracle Trade Management 12.2.4 through 12.2.12
Oracle Trade Management 12.2.13

Discovery Timeline

2024-04-16 - CVE-2024-21076 published to the National Vulnerability Database (NVD)
2024-04-16 - Oracle releases the April 2024 Critical Patch Update addressing the issue
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-21076

Vulnerability Analysis

The vulnerability resides in the Offer List of Values (LOV) component of Oracle Trade Management. The component is exposed over HTTP and fails to enforce proper authorization on requests. Because the flaw maps to [CWE-284] Improper Access Control, the affected endpoint accepts requests without verifying caller identity or entitlement. The impact is confined to confidentiality. Integrity and availability of Oracle Trade Management remain unaffected by exploitation. The attacker requires only network reachability to the affected Oracle E-Business Suite instance.

Root Cause

The Offer LOV component does not adequately validate access permissions before returning data. Oracle has not disclosed the specific source-level defect, but the behavior is consistent with a missing authorization check on an HTTP endpoint that exposes trade management records. Any anonymous client able to reach the endpoint can request data the application should restrict to authenticated and authorized users.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests to the Offer LOV endpoint exposed by an internet-reachable or intranet-reachable Oracle Trade Management deployment. The server returns Trade Management data without enforcing authentication. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.577% (43.2 percentile).

No verified exploit code is available for CVE-2024-21076. Refer to the Oracle Critical Patch Update April 2024 for vendor-supplied technical details.

Detection Methods for CVE-2024-21076

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle E-Business Suite Trade Management URLs containing OfferLOV or related Offer LOV servlet paths.
Large or unusual volumes of responses returning Trade Management records to sessions without an authenticated user context.
Access to Oracle Trade Management endpoints from unexpected source IP ranges, geographies, or automated user agents.

Detection Strategies

Inspect Oracle HTTP Server and WebLogic access logs for requests to Offer LOV endpoints that lack a valid session cookie or ICX_SESSION token.
Correlate web access logs with application authentication events to flag data-returning responses that have no preceding successful login.
Deploy web application firewall signatures that match Offer LOV request patterns and alert on anonymous access.

Monitoring Recommendations

Monitor Oracle E-Business Suite components for outbound data volume anomalies on Trade Management endpoints.
Alert on HTTP 200 responses to Offer LOV requests from IP addresses outside trusted administrative ranges.
Track patch level via AD_PATCH views and alert when production instances fall behind the April 2024 CPU baseline.

How to Mitigate CVE-2024-21076

Immediate Actions Required

Apply the April 2024 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.13 environments running Oracle Trade Management.
Restrict network access to Oracle E-Business Suite HTTP listeners so only trusted networks and VPN users can reach Trade Management endpoints.
Review web server access logs for prior unauthenticated requests to Offer LOV URLs and investigate any matches as potential data exposure events.

Patch Information

Oracle released fixes in the April 2024 Critical Patch Update. Administrators should review the Oracle Critical Patch Update April 2024 advisory and apply the patches corresponding to their Oracle E-Business Suite 12.2.x release level. No workaround replaces patching, because the fix corrects the missing authorization check at the application layer.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or WAF that enforces authentication before requests reach the Offer LOV endpoint.
Use URL firewall rules in Oracle E-Business Suite to deny external access to Trade Management servlet paths until patches are applied.
Limit Oracle Trade Management exposure to internal networks only, removing any direct internet exposure of the affected endpoints.

bash

# Example: restrict access to Trade Management URLs at the reverse proxy
location ~* /OA_HTML/.*Offer.*LOV {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://ebs-internal;
}