CVE-2024-21252: Oracle Product Hub Auth Bypass Flaw

CVE-2024-21252 Overview

CVE-2024-21252 is a high-severity vulnerability in the Oracle Product Hub product of Oracle E-Business Suite, specifically within the Item Catalog component. The flaw affects supported versions 12.2.3 through 12.2.13. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle Product Hub. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Product Hub accessible data. The vulnerability is categorized under [CWE-862] Missing Authorization.

Critical Impact
Authenticated attackers can read and modify all data accessible to Oracle Product Hub over the network with low attack complexity.

Affected Products

Oracle Product Hub version 12.2.3
Oracle Product Hub versions 12.2.4 through 12.2.12
Oracle Product Hub version 12.2.13

Discovery Timeline

2024-10-15 - CVE-2024-21252 published to NVD
2024-10-15 - Oracle releases fix in Critical Patch Update October 2024
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21252

Vulnerability Analysis

The vulnerability resides in the Item Catalog component of Oracle Product Hub, a master data management module within Oracle E-Business Suite. The flaw allows a low-privileged authenticated user to perform actions outside their authorization scope. Attackers reach the vulnerable functionality over HTTP without user interaction. Impact includes both confidentiality and integrity compromise of all data accessible to Oracle Product Hub, while availability remains unaffected.

Because Oracle Product Hub centralizes product master data across enterprise workflows, unauthorized modification can propagate downstream to procurement, manufacturing, and financial modules. The scope is unchanged, meaning the attacker operates within the security boundary of the vulnerable component.

Root Cause

Oracle has not publicly disclosed implementation-level details. Based on the [CWE-862] Missing Authorization classification, the root cause is an absent or insufficient authorization check on an HTTP-facing operation within the Item Catalog component. The application does not validate whether the authenticated principal has permission to perform the requested action against target catalog records.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. The attacker sends crafted HTTP requests to the Item Catalog endpoints that lack proper authorization enforcement. No user interaction and no elevated privileges are required. Refer to the Oracle Security Alert October 2024 for vendor-provided context.

No public proof-of-concept code has been published for this vulnerability. Oracle typically restricts technical exploitation details in its Critical Patch Update advisories.

Detection Methods for CVE-2024-21252

Indicators of Compromise

Unexpected creation, modification, or deletion events in Oracle Product Hub Item Catalog audit tables from low-privileged accounts.
HTTP requests from unusual source IPs targeting Oracle E-Business Suite Product Hub endpoints outside normal business workflows.
Anomalous Oracle E-Business Suite application session activity where users access catalog data outside their assigned responsibility.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Product Hub responsibility.
Correlate database audit logs (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) with Item Catalog table changes to spot privilege mismatches.
Baseline normal API and form usage patterns for Product Hub users and alert on deviations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database logs to a centralized SIEM for correlation and retention.
Monitor Oracle HTTP Server access logs for POST and PUT requests to Product Hub URLs originating from accounts without catalog administration roles.
Alert on bulk changes to EGO_ITEM_* and related Product Hub tables outside change-window schedules.

How to Mitigate CVE-2024-21252

Immediate Actions Required

Apply the Oracle Critical Patch Update from October 2024 to all affected Oracle E-Business Suite 12.2 instances.
Inventory Oracle Product Hub deployments and confirm the installed version against the affected range 12.2.3-12.2.13.
Review and reduce the set of accounts holding any Product Hub responsibility, especially non-administrative users.

Patch Information

Oracle addressed CVE-2024-21252 in the Oracle Critical Patch Update October 2024. Administrators should download and apply the Product Hub patches referenced in that advisory to all supported 12.2.x installations. Oracle does not issue patches for unsupported versions, so upgrades may be required for environments outside standard support.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using perimeter firewalls, VPN gateways, or reverse proxies until patching is complete.
Revoke Product Hub responsibilities from users who do not require catalog access as a compensating control.
Enable Oracle E-Business Suite auditing on Item Catalog operations to increase detection capability while patch deployment is scheduled.

bash

# Verify Oracle E-Business Suite patch level after applying the October 2024 CPU
# Run from the application tier as the applmgr user
source $APPL_TOP/APPS<CONTEXT>.env
adop -status
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number IN ('36878146','36878147')
 ORDER BY creation_date DESC;
EOF