CVE-2024-21278: Oracle E-Business Suite Auth Bypass

CVE-2024-21278 Overview

CVE-2024-21278 is an authorization vulnerability in the Oracle Contract Lifecycle Management for Public Sector product, part of Oracle E-Business Suite. The flaw resides in the Award Processes component and affects supported versions 12.2.3 through 12.2.13. A low-privileged attacker with network access over HTTP can exploit the vulnerability to gain unauthorized read, create, delete, or modify access to all data accessible to Oracle Contract Lifecycle Management for Public Sector. Oracle addressed the issue in the October 2024 Critical Patch Update.

Critical Impact
Authenticated attackers can compromise the confidentiality and integrity of all data managed by Oracle Contract Lifecycle Management for Public Sector, including sensitive government contract records.

Affected Products

Oracle E-Business Suite 12.2.3
Oracle Contract Lifecycle Management for Public Sector versions 12.2.3 through 12.2.13
Award Processes component of Oracle E-Business Suite

Discovery Timeline

2024-10-15 - Oracle publishes advisory as part of the October 2024 Critical Patch Update
2024-10-15 - CVE-2024-21278 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21278

Vulnerability Analysis

CVE-2024-21278 is an authorization weakness [CWE-863] in the Award Processes component of Oracle Contract Lifecycle Management for Public Sector. The product manages federal, state, and local government contracting workflows, including solicitations, awards, and modifications. A missing or incorrect authorization check allows an authenticated user with limited privileges to perform actions outside their assigned role.

Successful exploitation yields unauthorized read access to all data the application can reach. Attackers can also create, delete, or modify records within the Contract Lifecycle Management module. Because the application processes procurement and award data, the integrity impact extends to contract terms, vendor selections, and financial obligations.

The vulnerability requires only network access over HTTP and a valid low-privilege account. Attack complexity is low and no user interaction is required, making the flaw practical for insiders or attackers who have already obtained credentials through phishing or credential stuffing.

Root Cause

The root cause is an incorrect authorization check within the Award Processes component. The application fails to enforce the correct privilege boundary before executing sensitive operations against contract records, allowing horizontal and vertical access outside the intended role scope.

Attack Vector

The attack is delivered over HTTP against the Oracle E-Business Suite web tier. An authenticated attacker submits requests to Award Processes endpoints to read or manipulate contract data. No specialized tooling is required beyond authenticated HTTP access to the application.

No verified public proof-of-concept is available. See the Oracle Critical Patch Update October 2024 advisory for vendor-supplied technical detail.

Detection Methods for CVE-2024-21278

Indicators of Compromise

Unexpected create, update, or delete operations against Contract Lifecycle Management award tables performed by low-privileged user accounts.
HTTP request patterns targeting Award Processes URLs from user sessions that historically only performed read operations.
Access to contract or award records outside the user's assigned organization, buyer group, or contracting authority.

Detection Strategies

Enable Oracle E-Business Suite auditing (FND_LOG, Sign-On Audit, and page access tracking) on Contract Lifecycle Management responsibilities and correlate privileged actions against role assignments.
Baseline normal Award Processes activity per user role, then alert on deviations such as bulk record modification or cross-organization access.
Deploy web application firewall or reverse proxy logging in front of the E-Business Suite web tier to capture full request URIs and parameters for later replay analysis.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and Apache access logs to a centralized analytics platform for retention and correlation.
Monitor FND_USER and responsibility assignment tables for unexpected privilege changes that could indicate follow-on exploitation.
Alert on administrative queries against PON_* and OKC_* schema objects originating from application accounts outside expected maintenance windows.

How to Mitigate CVE-2024-21278

Immediate Actions Required

Apply the October 2024 Critical Patch Update from Oracle to all E-Business Suite environments running Contract Lifecycle Management for Public Sector versions 12.2.3 through 12.2.13.
Inventory user accounts with access to Contract Lifecycle Management responsibilities and remove entitlements that are no longer required.
Rotate credentials for any low-privileged accounts that showed anomalous Award Processes activity prior to patching.

Patch Information

Oracle released fixes as part of the October 2024 Critical Patch Update. Review the Oracle Critical Patch Update October 2024 advisory for the specific patch identifiers that apply to your E-Business Suite 12.2.x deployment, then follow the standard Oracle AD patch application procedure using adop.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier to trusted internal networks and VPN clients until patches are applied.
Reduce the number of users assigned Contract Lifecycle Management for Public Sector responsibilities to the minimum required for business operations.
Enable and review Sign-On Audit and page access tracking on affected responsibilities to detect exploitation attempts during the patch window.

bash

# Example: apply an Oracle E-Business Suite patch using adop online patching
# Refer to the October 2024 Critical Patch Update advisory for exact patch numbers
source $APPL_TOP/APPS<CONTEXT>.env
adop phase=prepare
adop phase=apply patches=<CPUOCT2024_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup