CVE-2024-21150: Oracle JD Edwards EnterpriseOne Auth Bypass

CVE-2024-21150 Overview

CVE-2024-21150 is a vulnerability in the Oracle JD Edwards EnterpriseOne Tools product, specifically within the Web Runtime SEC component. The flaw affects all supported versions prior to 9.2.8.2. An unauthenticated attacker with network access over HTTP can exploit the issue, but successful attacks require user interaction from a victim other than the attacker. Because the vulnerability results in a scope change, it can affect resources beyond the vulnerable component. Successful exploitation can lead to unauthorized modification of a subset of JD Edwards EnterpriseOne Tools data and unauthorized read access to accessible data.

Critical Impact
Remote, unauthenticated attackers can trick authenticated users into triggering actions that alter or disclose JD Edwards EnterpriseOne Tools data, with impact extending beyond the vulnerable component due to a scope change.

Affected Products

Oracle JD Edwards EnterpriseOne Tools versions prior to 9.2.8.2
Component: Web Runtime SEC
Deployments exposing the JD Edwards EnterpriseOne web interface over HTTP

Discovery Timeline

2024-07-16 - Oracle disclosed the vulnerability in the Oracle Critical Patch Update July 2024
2024-07-16 - CVE-2024-21150 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21150

Vulnerability Analysis

The vulnerability resides in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools. The attack vector is network-based over HTTP and requires no authentication, but does require user interaction, consistent with client-side injection or cross-site scripting behavior. The scope change indicated in the CVSS vector reflects that a successful exploit against the JD Edwards web runtime can affect additional products and data outside of the vulnerable component's original security authority.

Oracle classifies the impact as low confidentiality and low integrity, with no direct availability impact. In practice, this maps to unauthorized read access to a subset of accessible data and unauthorized insert, update, or delete access to other data. The categorization aligns with [CWE-284: Improper Access Control].

Root Cause

The root cause is improper access control in the Web Runtime SEC component, which handles security-related web runtime processing. Insufficient validation or filtering of attacker-influenced content served through the web runtime allows an external actor to induce a targeted user to perform actions or process content that the security layer should have restricted.

Attack Vector

An attacker crafts a malicious HTTP request or URL targeting the JD Edwards EnterpriseOne web runtime and delivers it to a legitimate user, typically through phishing or a malicious link. When the victim, who may hold an authenticated session, interacts with the payload, the web runtime processes the request in the user's security context. The scope change then allows impact to propagate to associated JD Edwards data and adjacent products.

No public proof-of-concept or exploit code is available for CVE-2024-21150. See the Oracle Critical Patch Update July 2024 for vendor-authoritative technical details.

Detection Methods for CVE-2024-21150

Indicators of Compromise

Unexpected HTTP requests to JD Edwards EnterpriseOne web runtime endpoints originating from external referrers or embedded in emails.
Authenticated user sessions performing insert, update, or delete operations that do not correlate with normal application workflows.
Web server logs containing encoded script fragments or unusual query parameters targeting Web Runtime SEC URLs.

Detection Strategies

Inspect web application firewall and reverse proxy logs for anomalous JD Edwards EnterpriseOne request patterns paired with external Referer headers.
Correlate authenticated JD Edwards user activity against expected business process timing and geolocation.
Deploy signatures that flag suspicious payload structures reaching the Web Runtime SEC component on affected versions.

Monitoring Recommendations

Enable verbose HTTP access logging on the JD Edwards web server tier and forward logs to a centralized analytics platform.
Alert on data-modification events performed within seconds of a user clicking an inbound link from external mail.
Track version banners and patch levels of JD Edwards EnterpriseOne Tools deployments to identify hosts still below 9.2.8.2.

How to Mitigate CVE-2024-21150

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2024 and upgrade Oracle JD Edwards EnterpriseOne Tools to version 9.2.8.2 or later.
Inventory all internet-exposed JD Edwards EnterpriseOne web runtime endpoints and restrict access to trusted networks where feasible.
Notify JD Edwards users of phishing risk and reinforce the requirement to validate links before authenticating.

Patch Information

Oracle released the fix as part of the July 2024 Critical Patch Update. Refer to the Oracle Critical Patch Update July 2024 advisory for patch identifiers, affected version matrices, and installation guidance. Upgrading to JD Edwards EnterpriseOne Tools 9.2.8.2 or later remediates CVE-2024-21150.

Workarounds

Place JD Edwards EnterpriseOne web interfaces behind a web application firewall with rules that filter suspicious payloads targeting Web Runtime SEC.
Enforce strict Content-Security-Policy and X-Frame-Options headers on the JD Edwards web tier to reduce client-side abuse.
Require VPN or zero-trust network access for JD Edwards EnterpriseOne users until patching is complete.

bash

# Example WAF rule concept for a reverse proxy in front of JD Edwards EnterpriseOne
# Block requests to the web runtime that contain suspicious script patterns
SecRule REQUEST_URI "@contains /jde/" \
    "chain,phase:2,deny,status:403,id:1002115,\
     msg:'Potential CVE-2024-21150 exploit against JD Edwards Web Runtime SEC'"
SecRule ARGS|REQUEST_HEADERS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "t:none,t:urlDecodeUni"