CVE-2025-50090: Oracle E-Business Suite CSRF Vulnerability

CVE-2025-50090 Overview

CVE-2025-50090 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Oracle Applications Framework product of Oracle E-Business Suite. The affected component is Personalization. Supported versions 12.2.3 through 12.2.14 are impacted.

An authenticated attacker with low privileges and network access via HTTP can compromise Oracle Applications Framework. Exploitation requires user interaction from a victim other than the attacker. Successful attacks can lead to unauthorized create, update, or delete access on some data, and unauthorized read access to a subset of data. The vulnerability produces a scope change, meaning impact may extend to additional products beyond Oracle Applications Framework.

Critical Impact
Successful exploitation permits unauthorized modification and limited disclosure of Oracle E-Business Suite data through a victim-in-the-middle CSRF attack, with scope extending to additional products.

Affected Products

Oracle E-Business Suite version 12.2.3
Oracle E-Business Suite versions 12.2.4 through 12.2.13
Oracle E-Business Suite version 12.2.14

Discovery Timeline

2025-07-15 - Oracle publishes the July 2025 Critical Patch Update addressing CVE-2025-50090
2025-07-15 - CVE-2025-50090 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50090

Vulnerability Analysis

The flaw resides in the Personalization component of Oracle Applications Framework (OAF), the Java-based UI framework underpinning Oracle E-Business Suite (EBS). The weakness is classified as Cross-Site Request Forgery [CWE-352], meaning state-changing HTTP requests are accepted without adequate proof that the request originated from an intentional user action within the application.

An attacker who holds low-privileged EBS credentials can craft a malicious page or link. When an authenticated victim, typically a higher-privileged user, is lured to visit the attacker-controlled resource, the browser submits authenticated requests to the OAF Personalization endpoints on behalf of the victim. The scope change indicates that resulting personalization modifications can cascade into other Oracle EBS modules that consume the framework.

Human interaction from a user other than the attacker is required, which aligns with the classic CSRF pattern of social-engineered link or embedded content delivery.

Root Cause

The root cause is missing or insufficient anti-CSRF protections on Personalization operations within Oracle Applications Framework. State-changing requests do not adequately validate the origin, referer, or a synchronizer token bound to the user session, allowing forged requests to succeed when the victim is authenticated.

Attack Vector

Exploitation follows a standard CSRF chain. The attacker authenticates with low-privileged EBS credentials to understand endpoint parameters, then hosts a malicious HTML page containing forged form submissions or image tags that target the vulnerable OAF Personalization URLs. When a higher-privileged EBS user with an active session visits the page, the browser transmits the request with the victim's cookies. The server executes the personalization change, insert, or delete operation, and the scope change permits impact on additional Oracle products.

No verified public exploit code is available. See the Oracle July 2025 Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2025-50090

Indicators of Compromise

Unexpected modifications to OAF personalization records committed by user accounts that do not normally perform personalization changes.
HTTP requests to Oracle Applications Framework Personalization endpoints with Referer or Origin headers pointing to external, non-EBS domains.
Bursts of state-changing OAF requests immediately following a user click on an external link received via email or chat.

Detection Strategies

Enable and review Oracle EBS Sign-On Audit and page-access logs for personalization changes correlated with anomalous referer values.
Instrument the reverse proxy or WAF fronting EBS to log and alert on POST requests to OAF Personalization paths with missing or foreign origins.
Correlate web access logs with FND_USER activity to identify personalization mutations occurring outside normal administrative workflows.

Monitoring Recommendations

Forward EBS application server, Oracle HTTP Server, and WAF logs to a centralized analytics platform for cross-source correlation.
Baseline normal personalization activity per role, then alert on deviations in frequency, source IP, or user agent.
Monitor for the July 2025 Oracle Critical Patch Update deployment status across all EBS environments to confirm remediation coverage.

How to Mitigate CVE-2025-50090

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2025 Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.14 instances.
Inventory internet-exposed EBS deployments and prioritize them for patching, since the attack vector is Network with low attack complexity.
Notify EBS users, particularly privileged administrators, of active CSRF phishing risk and reinforce the practice of avoiding untrusted links while authenticated to EBS.

Patch Information

Oracle addressed CVE-2025-50090 in the July 2025 Critical Patch Update. Refer to the Oracle July 2025 Security Alert for the specific patch identifiers per supported version. Oracle strongly recommends applying Critical Patch Update fixes as soon as possible; unsupported EBS versions may be affected but are not tested by Oracle.

Workarounds

Restrict EBS access to trusted networks or require VPN and enforce short session timeouts to shrink the CSRF exploitation window.
Deploy a WAF rule that rejects state-changing requests to OAF Personalization endpoints when Origin or Referer headers are absent or do not match the EBS hostname.
Enforce SameSite=Strict or SameSite=Lax on EBS session cookies where compatible to reduce cross-site request delivery.

bash

# Example WAF/ModSecurity rule: block cross-origin POSTs to OAF endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1005090,phase:1,deny,status:403,\
  msg:'CVE-2025-50090: Cross-origin POST to Oracle Applications Framework'"
  SecRule REQUEST_URI "@rx /OA_HTML/(OA|RF)\.jsp" "chain"
    SecRule REQUEST_HEADERS:Origin "!@rx ^https://ebs\.example\.com$"