CVE-2024-21167: Oracle Trading Community Auth Bypass Flaw

CVE-2024-21167 Overview

CVE-2024-21167 is a high-severity vulnerability in the Party Search UI component of Oracle Trading Community, part of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.13 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Trading Community. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Trading Community accessible data. Oracle published the fix in the July 2024 Critical Patch Update.

Critical Impact
An authenticated attacker over the network can read, modify, and delete critical business data across Oracle Trading Community, affecting both confidentiality and integrity of customer, partner, and account records.

Affected Products

Oracle Trading Community 12.2.3
Oracle Trading Community versions 12.2.4 through 12.2.12
Oracle Trading Community 12.2.13

Discovery Timeline

2024-07-16 - CVE-2024-21167 published to NVD as part of Oracle Critical Patch Update July 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21167

Vulnerability Analysis

The vulnerability resides in the Party Search UI component of Oracle Trading Community, the customer data model (TCA) underpinning Oracle E-Business Suite. The Party Search UI exposes search functionality over HTTP that is reachable by any authenticated user of the application. An attacker with valid low-privilege application credentials can send crafted requests to this interface and gain read, write, and delete access to Oracle Trading Community data beyond their authorization scope. Oracle assigned this weakness to the [NVD-CWE-noinfo] category, indicating that the specific weakness class was not disclosed in the advisory. The impact covers all Trading Community accessible data, which typically includes party, contact, account, and relationship records used across CRM, order management, and financial modules.

Root Cause

Oracle has not published the underlying weakness class. Based on the CVSS profile (network-accessible, low complexity, low-privilege authenticated, confidentiality and integrity impact without availability impact), the root cause is consistent with an access control or input handling flaw in the Party Search UI that fails to restrict data operations to authorized parties.

Attack Vector

Exploitation requires network access to the E-Business Suite application over HTTP and a valid low-privilege user account. No user interaction is required. The attacker sends specifically crafted requests to the Party Search UI endpoint of Oracle Trading Community to trigger unauthorized data operations. Because the scope is unchanged and no availability impact is reported, the attacker leverages legitimate application flows rather than crashing the service.

No verified public proof-of-concept code is available for this issue. Refer to the Oracle Security Alert July 2024 for vendor-supplied technical detail.

Detection Methods for CVE-2024-21167

Indicators of Compromise

Unusual volumes of HTTP requests to Party Search UI endpoints under /OA_HTML/ from low-privilege application accounts.
Unexpected create, update, or delete operations on HZ_PARTIES, HZ_PARTY_SITES, HZ_CUST_ACCOUNTS, or related Trading Community tables originating from non-administrative sessions.
Application audit log entries showing party record modifications performed by users outside the normal data steward role.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to capture user-level access to Party Search UI pages.
Correlate database-level auditing on Trading Community tables with application session identifiers to detect unauthorized data changes.
Baseline expected Party Search UI usage per role and alert on deviations, particularly bulk read or modification patterns.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized analytics platform for correlation.
Monitor the July 2024 Critical Patch Update deployment status across all E-Business Suite environments, including development and staging.
Track outbound data volumes from application servers hosting Trading Community to identify potential data exfiltration.

How to Mitigate CVE-2024-21167

Immediate Actions Required

Apply the Oracle Critical Patch Update dated July 2024 to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.13.
Inventory all low-privilege application accounts and disable or rotate credentials for accounts that are unused or shared.
Restrict network reachability of E-Business Suite Party Search UI endpoints to trusted internal networks and VPN users.

Patch Information

Oracle addressed CVE-2024-21167 in the July 2024 Critical Patch Update. Administrators should download and apply the relevant patch for Oracle Trading Community per the guidance in the Oracle Security Alert July 2024. No standalone workaround is provided by Oracle; patching is the supported remediation.

Workarounds

Where immediate patching is not possible, restrict access to Party Search UI functions using Oracle E-Business Suite responsibilities and function security to authorized data stewards only.
Place a reverse proxy or Web Application Firewall in front of E-Business Suite and block anomalous parameters or excessive request rates to Party Search endpoints.
Enforce multi-factor authentication for all E-Business Suite users to raise the cost of credential-based access required by this vulnerability.

bash

# Verify patch level on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM ad_bugs
WHERE bug_number IN ('<CPU_JUL_2024_BUG_ID>')
ORDER BY last_update_date DESC;
EOF