CVE-2021-2401

What it actually does

This is an unauthenticated, network-exploitable XML External Entity (XXE)-class weakness reachable over HTTP. A vulnerable BI Publisher/XDO-style XML processing endpoint may parse attacker-supplied XML that references external entities, allowing the attacker to cause the server-side parser to retrieve and disclose limited data accessible to the application process. The stated impact is confidentiality only: unauthorized read access to a subset of application-accessible data, with no direct integrity or availability impact in the CVSS assessment. The supplied product metadata also lists fastify-static fixed versions; because that conflicts with the Oracle BI Publisher description, affected-asset validation should confirm which product advisory applies before remediation is considered complete.

Why it matters to the business

An attacker who can reach the vulnerable HTTP service may be able to read sensitive application data without signing in, which can lead to exposure of reports, configuration details, internal file contents, or data accessible to the publishing service. Although the CVSS score is moderate, the EPSS score is high, indicating elevated likelihood of exploitation activity relative to many vulnerabilities; internet-facing deployments should therefore be treated as urgent. The issue is not listed in CISA KEV and is not marked as ransomware-used in the provided data, but the long time since publication means unpatched exposed systems are likely to be easily identifiable by attackers and scanners.

How an attack unfolds

An attacker first identifies an exposed HTTP service running an affected BI Publisher/XDO component or another affected product indicated by the advisory metadata. The attacker then sends a crafted XML-bearing request to an endpoint that invokes server-side XML parsing. If the parser permits external entity expansion, the server resolves attacker-controlled entity references and reads local or remote resources available to the application process. The attacker receives the resolved content in the HTTP response, an error message, a generated report, or through an out-of-band callback to attacker-controlled infrastructure. Repeated requests may be used to enumerate readable files, configuration values, report metadata, or internal service responses. No authentication or user interaction is required according to the CVSS vector.

How to fix it

Apply the vendor security update for the affected product line. For Oracle BI Publisher / Oracle Fusion Middleware / E-Business Suite XDO deployments, apply the relevant Oracle Critical Patch Update that remediates CVE-2021-2401 for affected versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0, and verify that all BI Publisher nodes, clustered servers, and standby systems are patched. Because the supplied affected-product metadata also lists fastify-static, validate software inventory carefully; if fastify-static is present and in scope for this advisory feed, upgrade npm package fastify-static to 4.4.1 or later, or ensure the Git source includes commit f324f8b5013a130885c4857aad50afa113f21eae. As compensating controls, restrict external access to BI Publisher administrative and XML-processing endpoints, require authentication at a reverse proxy where feasible, block unexpected outbound HTTP/DNS access from application servers, disable external entity resolution in XML parsers where configurable, and monitor for XML payloads containing DTD or entity declarations.

How to confirm the fix worked

Confirm the installed BI Publisher/Fusion Middleware/E-Business Suite XDO versions and patch inventory against the vendor CPU advisory, not only package names in dependency scanners. For fastify-static findings, confirm package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls output, or source commit history shows fastify-static 4.4.1 or later, or commit f324f8b5013a130885c4857aad50afa113f21eae. Validate exposure by checking whether affected HTTP endpoints are reachable from untrusted networks. Use a safe non-destructive XXE test in a controlled environment to verify that external entity resolution is blocked and that no outbound callback is generated. Review application configuration to ensure XML parsers disallow DTDs and external entities. After patching, rescan externally and internally and verify that WAF/reverse-proxy logs no longer show accepted XML requests containing DOCTYPE or ENTITY declarations to BI Publisher/XDO endpoints.

Typical attack path

1. Discover exposed Oracle BI Publisher/Fusion Middleware/XDO or otherwise affected HTTP endpoints through scanning, search engines, or fingerprinting.
2. Identify XML-processing functionality such as report generation, template upload, SOAP/XML APIs, or document conversion endpoints.
3. Submit a crafted XML request containing external entity declarations or references.
4. Cause the vulnerable server-side XML parser to resolve the entity using the application server’s privileges and network position.
5. Recover disclosed data from the HTTP response, application error output, generated content, or an out-of-band network interaction.
6. Repeat selectively to access additional application-readable files, configuration data, report data, or internal URLs.

How to detect it

Review HTTP access logs, reverse-proxy logs, WAF events, application server logs, BI Publisher logs, XML parser errors, EDR telemetry, DNS logs, and outbound proxy/firewall logs. Focus on unauthenticated requests to BI Publisher/XDO/XML/reporting endpoints that include DTD or external entity syntax, especially requests containing <!DOCTYPE, <!ENTITY, SYSTEM, PUBLIC, file://, http://, https://, ftp://, gopher://, or references to cloud metadata addresses. Look for XML parser exceptions that mention external entities, disallowed DOCTYPE declarations, SAXParseException, XMLStreamException, or attempts to resolve local files. Correlate inbound suspicious XML requests with outbound DNS/HTTP requests from application servers to unusual domains or IPs, because XXE exploitation often uses out-of-band callbacks to confirm parsing or exfiltrate data. Also investigate responses with abnormal sizes, repeated 4xx/5xx errors around XML endpoints, and requests attempting to read common sensitive files such as /etc/passwd, Windows initialization files, application configuration files, wallet/keystore files, or cloud instance metadata.

• <!DOCTYPE
• <!ENTITY
• SYSTEM "file:
• SYSTEM 'file:
• PUBLIC "-//
• file:///etc/passwd
• file:/etc/passwd
• file:///c:/windows/win.ini
• C:\\Windows\\win.ini
• http://169.254.169.254
• http://metadata.google.internal
• http://169.254.169.254/latest/meta-data
• ftp://
• gopher://
• /xmlpserver
• /xmlpserver/servlet
• /xmlpserver/services
• /OA_HTML
• XDO
• BI Publisher
• SAXParseException
• XMLStreamException
• DOCTYPE is disallowed
• External Entity
• external entity
• entity reference
• DocumentBuilderFactory
• SAXParserFactory
• oracle.xdo

What your security team should do

• Prioritize externally reachable BI Publisher/XDO or affected HTTP services for patching because the EPSS score is high despite the moderate CVSS score.
• Resolve the product-metadata conflict by confirming whether the finding applies to Oracle BI Publisher/Fusion Middleware, fastify-static, or both in the vulnerability management source of truth.
• Patch Oracle BI Publisher/Fusion Middleware/E-Business Suite XDO through the applicable Oracle Critical Patch Update; patch fastify-static to 4.4.1 or later where that package is actually present.
• Restrict unauthenticated internet access to report publishing, XML, SOAP, and template-processing endpoints until patching is complete.
• Disable XML external entity processing and DTD support in application XML parsers wherever the platform allows it.
• Block or tightly control outbound HTTP, HTTPS, FTP, SMB, and DNS from application servers to reduce out-of-band data exfiltration via XXE.
• Hunt historical logs for XML payloads containing DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, and metadata-service URLs.
• Review any suspicious XML parsing errors, outbound callbacks, or unusual reads of configuration/report files as potential data exposure events.