CVE-2024-21254: Oracle BI Publisher Privilege Escalation

CVE-2024-21254 Overview

CVE-2024-21254 is a high-severity vulnerability in the Oracle BI Publisher product of Oracle Analytics, specifically in the Web Server component. The flaw affects supported versions 7.0.0.0.0, 7.6.0.0.0, and 12.2.1.4.0. An authenticated attacker with low privileges and network access via HTTP can exploit this issue to compromise Oracle BI Publisher. Successful exploitation results in full takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle addressed the vulnerability in the October 2024 Critical Patch Update.

Critical Impact
Successful exploitation allows a low-privileged, network-based attacker to fully take over Oracle BI Publisher, exposing sensitive report data and enabling arbitrary modification of the application.

Affected Products

Oracle BI Publisher 7.0.0.0.0
Oracle BI Publisher 7.6.0.0.0
Oracle BI Publisher 12.2.1.4.0

Discovery Timeline

2024-10-15 - Oracle disclosed the vulnerability as part of the October 2024 Critical Patch Update
2024-10-15 - CVE-2024-21254 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21254

Vulnerability Analysis

The vulnerability resides in the Web Server component of Oracle BI Publisher, a reporting platform bundled with Oracle Analytics. Oracle categorizes the issue as easily exploitable, meaning attackers do not need specialized techniques or unusual conditions to trigger it. An attacker only needs valid low-privileged credentials and HTTP access to reach the BI Publisher web endpoint. Once exploited, the attacker gains full control of the BI Publisher instance, including access to reports, data sources, and administrative functions. NVD associates the weakness with CWE-862: Missing Authorization, indicating that a sensitive function or resource is reachable without the appropriate authorization check.

Root Cause

The underlying weakness is a missing authorization check within a Web Server code path in BI Publisher. Because the affected functionality does not properly verify whether the authenticated user is entitled to perform a given action, a low-privileged account can invoke functionality reserved for higher-privileged roles. This authorization gap enables privilege elevation within the application context.

Attack Vector

Exploitation requires only network HTTP access to the BI Publisher web interface and a valid low-privileged account. The attacker sends crafted HTTP requests to the vulnerable endpoint to invoke functionality that should be restricted, bypassing role-based controls. No user interaction is required, and the scope remains unchanged, but confidentiality, integrity, and availability of the BI Publisher instance are all impacted at a high level. Environments that expose BI Publisher to broad internal networks or the internet, or that provision self-service low-privileged accounts, are at elevated risk.

No public proof-of-concept is available for this vulnerability. See the Oracle Critical Patch Update - October 2024 advisory for vendor-provided technical details.

Detection Methods for CVE-2024-21254

Indicators of Compromise

Unexpected HTTP requests from low-privileged BI Publisher accounts targeting administrative or configuration endpoints of the Web Server component.
New or modified reports, data sources, or scheduled jobs created by accounts that do not normally perform administrative actions.
Outbound network connections initiated by the BI Publisher host to unfamiliar external addresses following report execution.
Creation of new user accounts or role assignments in BI Publisher without a corresponding change ticket.

Detection Strategies

Review BI Publisher web access logs for anomalous request patterns, particularly requests to sensitive endpoints from accounts with only report-consumer privileges.
Correlate BI Publisher application logs with authentication logs to identify low-privileged sessions performing high-privileged operations.
Baseline normal report execution behavior and alert on deviations, including unusual data source access or large data exports.

Monitoring Recommendations

Forward BI Publisher bipublisher.log, WebLogic access logs, and Oracle Analytics audit logs to a centralized logging platform for correlation.
Monitor for changes to BI Publisher configuration files, role definitions, and JDBC data source credentials.
Track process and network activity on the BI Publisher host to detect post-exploitation behavior such as command execution or lateral movement.

How to Mitigate CVE-2024-21254

Immediate Actions Required

Apply the October 2024 Oracle Critical Patch Update for Oracle Analytics and BI Publisher to all affected instances.
Inventory all Oracle BI Publisher deployments and confirm versions 7.0.0.0.0, 7.6.0.0.0, and 12.2.1.4.0 are remediated.
Restrict network access to the BI Publisher Web Server to trusted management networks until patching is complete.
Audit BI Publisher user accounts and revoke unnecessary low-privileged access, particularly for shared or service accounts.

Patch Information

Oracle released fixes for CVE-2024-21254 in the Oracle Critical Patch Update - October 2024. Administrators should follow the Oracle Analytics patch matrix in the advisory to select the correct patch for their BI Publisher version. Oracle recommends applying Critical Patch Updates without delay because attackers routinely target unpatched Oracle systems after each quarterly release.

Workarounds

Place BI Publisher behind a reverse proxy or web application firewall configured to restrict access to administrative URL paths.
Enforce network segmentation so that only trusted subnets can reach the BI Publisher HTTP interface.
Disable or delete unused low-privileged BI Publisher accounts to reduce the pool of credentials an attacker could leverage.
Enable and review BI Publisher audit logging to increase visibility while patching is scheduled.

bash

# Example: restrict access to BI Publisher via iptables to a management subnet
iptables -A INPUT -p tcp --dport 9502 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9502 -j DROP

# Verify installed BI Publisher version on the WebLogic host
cat $ORACLE_HOME/Oracle_BI1/bifoundation/version.txt