CVE-2024-21083 Overview
CVE-2024-21083 affects the Script Engine component of Oracle BI Publisher, part of the Oracle Analytics product family. The flaw allows a high-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in full takeover of Oracle BI Publisher, with impacts to confidentiality, integrity, and availability.
Oracle addressed the issue in the April 2024 Critical Patch Update. The vulnerability is associated with [CWE-863: Incorrect Authorization]. Supported versions 7.0.0.0.0 and 12.2.1.4.0 are affected.
Critical Impact
Authenticated attackers can take over Oracle BI Publisher instances over the network, exposing reporting data and enabling further pivoting into connected analytics environments.
Affected Products
- Oracle BI Publisher 7.0.0.0.0
- Oracle BI Publisher 12.2.1.4.0
- Oracle Analytics deployments using the BI Publisher Script Engine component
Discovery Timeline
- 2024-04-16 - CVE-2024-21083 published to NVD alongside the Oracle Critical Patch Update
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21083
Vulnerability Analysis
The vulnerability resides in the Script Engine component of Oracle BI Publisher. The Script Engine executes scripting logic used within BI Publisher reports and templates. Improper authorization checks allow a high-privileged authenticated user to invoke functionality that should be restricted.
Because the Script Engine executes report logic on the server, abuse of this pathway yields complete takeover of the BI Publisher instance. Attackers gain read and write access to reporting content, embedded credentials, and any datasources reachable from the server. The flaw is network-reachable over HTTP and requires no user interaction.
Oracle classifies this vulnerability as easily exploitable once the attacker holds the required privileges. High-privileged BI Publisher accounts are often granted to report developers and administrators, which broadens the practical attack surface beyond top-tier administrators.
Root Cause
The root cause is an incorrect authorization control ([CWE-863]) in the Script Engine. Privilege boundaries between administrative and scripting operations are not correctly enforced, allowing authorized users to reach functionality that should require additional restrictions.
Attack Vector
An attacker authenticates to Oracle BI Publisher with a high-privileged account and issues crafted HTTP requests targeting the Script Engine. Oracle has not published exploit details, and no public proof-of-concept is available. Refer to the Oracle Security Alert April 2024 for vendor guidance.
Detection Methods for CVE-2024-21083
Indicators of Compromise
- Unexpected HTTP requests to BI Publisher Script Engine endpoints from administrative or developer accounts outside normal work hours
- New or modified report templates containing scripting logic that references system commands, filesystem paths, or outbound network calls
- Creation of new high-privileged BI Publisher users or role escalations preceding Script Engine activity
- Outbound connections from the BI Publisher application server to previously unseen hosts
Detection Strategies
- Enable BI Publisher audit logging and forward events to a centralized log platform for correlation with authentication data
- Baseline normal Script Engine usage per user and alert on deviations in request volume, endpoints, or payload size
- Monitor the WebLogic server hosting BI Publisher for anomalous child processes spawned by the Java runtime
Monitoring Recommendations
- Track authentication events for high-privileged BI Publisher accounts and alert on logins from unusual source IPs
- Watch for changes to report definitions and scheduled jobs in the BI Publisher catalog
- Inspect egress traffic from the BI Publisher host for connections to unauthorized destinations
How to Mitigate CVE-2024-21083
Immediate Actions Required
- Apply the Oracle Critical Patch Update from April 2024 to all Oracle BI Publisher instances running versions 7.0.0.0.0 or 12.2.1.4.0
- Inventory BI Publisher accounts with administrative or scripting privileges and remove unnecessary grants
- Rotate credentials for all high-privileged BI Publisher users and any datasource accounts referenced by report definitions
- Restrict network access to BI Publisher management interfaces to trusted administrative networks
Patch Information
Oracle released fixes as part of the April 2024 Critical Patch Update. Administrators should follow the vendor guidance in the Oracle Security Alert April 2024 and apply the appropriate patch for their supported version.
Workarounds
- Enforce least privilege by limiting the number of accounts granted BI Publisher administrator or developer roles
- Place BI Publisher behind a reverse proxy or web application firewall that restricts access to Script Engine endpoints
- Require multi-factor authentication for all privileged BI Publisher accounts to raise the bar for credential compromise
- Segment BI Publisher servers from general user networks and monitor east-west traffic to reporting infrastructure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
