CVE-2024-21255: Oracle PeopleSoft PeopleTools RCE Vulnerability

CVE-2024-21255 Overview

CVE-2024-21255 affects the XMLPublisher component of Oracle PeopleSoft Enterprise PeopleTools. The flaw allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in full takeover of PeopleSoft Enterprise PeopleTools, impacting confidentiality, integrity, and availability. The vulnerability is mapped to XML External Entity (XXE) processing weaknesses [CWE-611].

Oracle disclosed the issue in the October 2024 Critical Patch Update. Affected versions include PeopleTools 8.59, 8.60, and 8.61.

Critical Impact
An authenticated attacker with minimal privileges can achieve complete takeover of PeopleSoft Enterprise PeopleTools over the network without user interaction.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.59
Oracle PeopleSoft Enterprise PeopleTools 8.60
Oracle PeopleSoft Enterprise PeopleTools 8.61

Discovery Timeline

2024-10-15 - Oracle publishes the October 2024 Critical Patch Update addressing CVE-2024-21255
2024-10-15 - CVE-2024-21255 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21255

Vulnerability Analysis

The vulnerability resides in the XMLPublisher component of PeopleSoft Enterprise PeopleTools. XMLPublisher generates reports by processing XML data and templates. Improper handling of XML input allows external entities to be resolved during parsing, classified as an XML External Entity (XXE) vulnerability [CWE-611].

An attacker holding a low-privileged PeopleSoft account can submit crafted XML content to XMLPublisher over HTTP. Because the parser processes attacker-controlled external entities, the attacker gains control over confidential data, application state, and service availability. Oracle characterizes successful exploitation as complete product takeover.

The EPSS score is 0.577%, placing exploitation likelihood in the 44.9th percentile at the time of assessment. No public proof-of-concept or in-the-wild exploitation has been catalogued in CISA KEV.

Root Cause

The root cause is unsafe XML parsing inside the XMLPublisher reporting component. XML processors that resolve external entities without restriction permit attackers to reference external Document Type Definitions (DTDs) or system resources. This behavior enables file disclosure, server-side request forgery, and, in the PeopleTools context, escalation to full application compromise.

Attack Vector

Exploitation is performed remotely over HTTP against PeopleSoft interfaces that accept XML documents processed by XMLPublisher. The attacker must authenticate with any low-privileged PeopleSoft account. No user interaction is required, and attack complexity is low.

The attacker submits an XML payload that declares an external entity referencing internal file system paths or attacker-controlled URIs. When XMLPublisher parses the document, the resolver dereferences the entity and returns its contents to the attacker or triggers outbound requests from the PeopleSoft server. See the Oracle Critical Patch Update - October 2024 for the vendor advisory.

Detection Methods for CVE-2024-21255

Indicators of Compromise

Unexpected outbound HTTP or FTP connections from the PeopleSoft application server to unknown external hosts, indicating XXE-triggered egress
HTTP requests to PeopleTools endpoints containing XML payloads with <!DOCTYPE>, <!ENTITY>, or SYSTEM declarations
XMLPublisher error logs referencing failed external entity resolution or unexpected file:// URI access
Access attempts to sensitive local files such as /etc/passwd, web.xml, or PeopleSoft configuration files from the application server process

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect HTTP request bodies to PeopleTools endpoints for XML external entity syntax
Correlate PeopleSoft application server process activity with unexpected file reads and outbound network connections
Monitor authentication logs for low-privileged accounts making atypical XMLPublisher report requests

Monitoring Recommendations

Enable verbose logging on the PeopleSoft web tier and forward logs to a centralized SIEM for retention and correlation
Baseline normal XMLPublisher traffic patterns and alert on payload size or content anomalies
Track file access and process spawning on PeopleSoft servers using endpoint telemetry

How to Mitigate CVE-2024-21255

Immediate Actions Required

Apply the October 2024 Oracle Critical Patch Update to PeopleTools 8.59, 8.60, and 8.61 without delay
Inventory all internet-exposed PeopleSoft instances and restrict them to trusted networks or VPN access
Review PeopleSoft user accounts and revoke unnecessary low-privileged access that could be abused for exploitation
Audit XMLPublisher usage logs for suspicious XML submissions preceding the patch date

Patch Information

Oracle addressed CVE-2024-21255 in the October 2024 Critical Patch Update. Administrators must apply the patches referenced in the Oracle Critical Patch Update Advisory - October 2024. No supported workaround replaces patching, and Oracle recommends immediate remediation for affected PeopleTools versions.

Workarounds

Restrict network access to PeopleSoft web interfaces using firewall rules or reverse proxy allowlists until patches are deployed
Enforce least-privilege access controls on PeopleSoft accounts to reduce the pool of attackers who satisfy the authentication precondition
Deploy WAF signatures that block HTTP requests containing XML external entity declarations targeting PeopleTools endpoints

bash

# Example WAF rule concept: block XML external entity payloads to PeopleSoft endpoints
# ModSecurity-style rule (adapt to your WAF)
SecRule REQUEST_URI "@contains /psp/" \
  "chain,phase:2,deny,status:403,id:1002124,\
   msg:'Potential XXE targeting PeopleSoft XMLPublisher (CVE-2024-21255)'"
  SecRule REQUEST_BODY "@rx (?i)<!ENTITY\s+[^>]+SYSTEM" "t:none"