CVE-2024-21214: Oracle PeopleSoft Auth Bypass Vulnerability

CVE-2024-21214 Overview

CVE-2024-21214 is a vulnerability in the Query component of Oracle PeopleSoft Enterprise PeopleTools. Affected versions include 8.59, 8.60, and 8.61. The flaw allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, plus unauthorized access to all PeopleSoft Enterprise PeopleTools accessible data. Oracle addressed the issue in the Oracle Critical Patch Update Advisory - October 2024.

Critical Impact
An authenticated attacker with low privileges can read and modify all data accessible through PeopleSoft Enterprise PeopleTools over the network with low attack complexity.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.59
Oracle PeopleSoft Enterprise PeopleTools 8.60
Oracle PeopleSoft Enterprise PeopleTools 8.61

Discovery Timeline

2024-10-15 - CVE-2024-21214 published to NVD alongside the Oracle October 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21214

Vulnerability Analysis

The vulnerability resides in the Query component of Oracle PeopleSoft Enterprise PeopleTools. PeopleTools Query is the reporting and ad-hoc data retrieval framework that authenticated PeopleSoft users use to build and run queries against application data. A flaw in this component permits an attacker with any low-privileged PeopleSoft account to exceed the intended data access boundaries.

Oracle classifies the issue as easily exploitable over HTTP without user interaction. The impact spans confidentiality and integrity, with no impact on availability. NVD assigned the weakness NVD-CWE-noinfo, indicating Oracle did not publish detailed root-cause information in the advisory.

Root Cause

Oracle's advisory does not disclose the specific weakness class. Based on the component and impact profile, the flaw permits query operations to bypass authorization checks tied to the PeopleTools Query engine, exposing and modifying records that should be restricted from the attacker's role. Consult the Oracle October 2024 Critical Patch Update for the vendor-provided technical scope.

Attack Vector

Exploitation requires network access to the PeopleSoft HTTP interface and a valid low-privileged PeopleSoft account. No user interaction is required. Once authenticated, the attacker submits crafted requests to the Query component to read or manipulate data outside the scope of their assigned permissions. Because the scope remains unchanged, the impact is bounded to PeopleTools data — but that data set includes application records, configuration, and query metadata.

No verified code examples are available. See the vendor advisory for technical details.

Detection Methods for CVE-2024-21214

Indicators of Compromise

Unexpected PeopleSoft Query definitions created, modified, or executed by low-privileged accounts outside their normal role scope.
HTTP requests to PeopleTools Query endpoints containing unusual record references or field selections not tied to the user's typical activity.
Anomalous volumes of data returned to Query sessions from accounts that historically run limited reports.

Detection Strategies

Enable PeopleSoft audit logging for the Query component and correlate query execution with user role assignments.
Baseline normal Query usage per user role, then alert on deviations such as new record access, unusual field selections, or off-hours execution.
Review PeopleTools access logs for HTTP requests to Query servlets originating from accounts with low PeopleSoft privileges.

Monitoring Recommendations

Forward PeopleSoft application, web server, and database audit logs to a centralized analytics platform for cross-correlation.
Monitor database query patterns from the PeopleSoft application account for row counts and table access that diverge from established baselines.
Track authentication events for low-privileged PeopleSoft accounts that suddenly begin issuing Query traffic.

How to Mitigate CVE-2024-21214

Immediate Actions Required

Apply the Oracle Critical Patch Update from October 2024 to all Oracle PeopleSoft Enterprise PeopleTools 8.59, 8.60, and 8.61 deployments.
Inventory all internet-exposed PeopleSoft instances and prioritize patching for those reachable from untrusted networks.
Audit PeopleSoft user accounts and disable or reset credentials for stale low-privileged accounts that could be leveraged by an attacker.

Patch Information

Oracle released fixes as part of the October 2024 Critical Patch Update. Administrators should reference the Oracle Security Alert - October 2024 for the exact patch identifiers applicable to PeopleTools 8.59, 8.60, and 8.61.

Workarounds

Restrict network access to the PeopleSoft HTTP interface to trusted corporate networks and VPN ranges until patches are deployed.
Enforce multi-factor authentication for all PeopleSoft accounts to raise the cost of acquiring the low-privileged access needed for exploitation.
Review PeopleTools Query permission lists and remove unnecessary record access from broad or default roles.

bash

# Example: restrict PeopleSoft web tier access at the network edge
# Replace <trusted_cidr> with your management network and <peoplesoft_host> with the target
iptables -A INPUT -p tcp --dport 443 -s <trusted_cidr> -d <peoplesoft_host> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <peoplesoft_host> -j DROP