CVE-2021-2456

What it actually does

CVE-2021-2456 is an unauthenticated, network-exploitable flaw in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0, in the Analytics Web General component. An attacker reachable over HTTP can compromise the OBIEE application without credentials or user interaction. The CVSS vector indicates full confidentiality, integrity, and availability impact, meaning successful exploitation can allow complete application takeover, unauthorized access to BI content and metadata, modification of reports or application state, and disruption of the service.

Why it matters to the business

A successful attack can give an external attacker control of a business intelligence platform that often contains sensitive operational, financial, customer, and executive reporting data. This can lead to data theft, falsified reporting, loss of trust in analytics outputs, service outage, and follow-on compromise of connected identity, database, or integration services. Although it is not listed in CISA KEV and no ransomware association is provided, the vulnerability is remotely exploitable without authentication, has a critical CVSS score of 9.8, and has a high EPSS score of 0.81366, so exposed systems should be treated as high priority even though the issue is several years old.

How an attack unfolds

An attacker first identifies an internet- or network-accessible Oracle Business Intelligence Enterprise Edition instance, typically by discovering exposed Oracle BI web paths such as the Analytics application. Because the vulnerability is exploitable over HTTP and requires no authentication, the attacker does not need valid user credentials. The attacker sends a crafted request to the vulnerable Analytics Web General component that triggers the flaw and results in compromise of the OBIEE application. After gaining control, the attacker can access or alter BI content, create or abuse administrative capabilities, disrupt reporting availability, and potentially use the compromised application as a foothold to reach connected data sources or internal services.

How to fix it

Apply the relevant Oracle Critical Patch Update that fixes this vulnerability for Oracle Business Intelligence Enterprise Edition 12.2.1.4.0, or upgrade to a currently supported, fully patched Oracle Analytics/Oracle Fusion Middleware release. Because no exact fixed package version was provided, use Oracle’s official advisory and patch inventory tooling to confirm the required patch set for the installed product version. If immediate patching is not possible, restrict access to OBIEE web interfaces to trusted networks or VPN users, block direct internet exposure, enforce WAF controls for suspicious unauthenticated requests to Oracle BI endpoints, disable unused BI components, and increase monitoring of Oracle BI, WebLogic, and HTTP access logs until patching is complete.

How to confirm the fix worked

Confirm the installed Oracle Business Intelligence Enterprise Edition version and patch inventory using Oracle OPatch or the vendor-supported inventory method, and verify that the CPU or later patch containing the fix for CVE-2021-2456 is installed. Validate that externally reachable HTTP/HTTPS services no longer expose unpatched OBIEE 12.2.1.4.0. Review web server, WebLogic, and OBIEE logs before and after remediation for unauthenticated requests to Analytics routes and unexpected errors. If network controls are used as interim mitigation, test from untrusted network locations to confirm the Oracle BI web interface is no longer reachable except through approved access paths.

Typical attack path

1. Discover an exposed Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 service over HTTP or HTTPS.
2. Fingerprint the application using Oracle BI/Analytics web routes, headers, login pages, or static resources.
3. Send unauthenticated crafted HTTP requests to the vulnerable Analytics Web General component.
4. Gain control over the Oracle Business Intelligence Enterprise Edition application context.
5. Access, export, modify, or delete BI reports, dashboards, metadata, and configuration available to the compromised application.
6. Attempt lateral movement or data access through trusted integrations, service accounts, databases, or identity connections used by the BI platform.
7. Establish persistence or conceal activity by creating accounts, changing configuration, altering logs, or deploying malicious files where write access is available.

How to detect it

Investigate whether the application was already exploited by reviewing HTTP access logs from Oracle HTTP Server, WebLogic, reverse proxies, load balancers, and WAFs for unauthenticated requests to Oracle BI Analytics endpoints, especially requests followed by 500-series errors, unusual redirects, administrative actions, or sudden authenticated activity from the same source. Review Oracle BI diagnostic logs, WebLogic server logs, managed server logs, audit logs, and application deployment directories for unexpected errors, newly created or modified files, suspicious configuration changes, or unexplained restarts. Examine BI audit trails for unusual report exports, dashboard access, privilege changes, account creation, catalog modifications, or access from unfamiliar IP addresses. On hosts, look for suspicious child processes spawned by Java/WebLogic processes, unexpected shell execution, outbound network connections from middleware servers, new scheduled tasks or cron entries, and files written under Oracle Middleware, domain, tmp, upload, or deployment directories. Because no public exploit artifact is specified in the input, detections should focus on anomalous unauthenticated access to Oracle BI web components and post-compromise behavior rather than a single definitive request signature.

• /analytics
• /analytics/
• /analytics/saw.dll
• /xmlpserver
• /bi-security-login
• Oracle Business Intelligence
• OBIEE
• sawlog
• sawserver
• sawserver.log
• AdminServer.log
• bi_server
• bi_server1
• DOMAIN_HOME/servers/AdminServer/logs/AdminServer.log
• DOMAIN_HOME/servers/bi_server1/logs/bi_server1.log
• DOMAIN_HOME/servers/bi_server1/tmp
• DOMAIN_HOME/servers/bi_server1/stage
• ORACLE_HOME/user_projects/domains
• java.lang.Runtime.exec
• ProcessBuilder
• cmd.exe /c
• /bin/sh -c

What your security team should do

• Prioritize patching any Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 deployment, especially if reachable from the internet or broad internal networks.
• Use Oracle OPatch or equivalent inventory evidence to prove the applicable Critical Patch Update has been applied; do not rely only on service banners or UI version strings.
• Temporarily restrict Oracle BI web access to trusted administrative and user networks until patching is complete.
• Review OBIEE, WebLogic, reverse proxy, load balancer, WAF, and EDR telemetry for suspicious unauthenticated requests and post-exploitation behavior.
• Hunt for unusual report exports, new or modified BI users or roles, unexpected configuration changes, and access to sensitive dashboards outside normal patterns.
• Rotate credentials and review permissions for service accounts or data source connections accessible from OBIEE if compromise is suspected.
• Ensure Oracle BI and related middleware logs are centralized, retained, and monitored for anomalous access and administrative actions.
• If the application is no longer required, decommission it rather than leaving an unsupported analytics platform exposed.