CVE-2022-21587

What it actually does

CVE-2022-21587 is an unauthenticated, network-exploitable authentication bypass in the Upload component of Oracle Web Applications Desktop Integrator within Oracle E-Business Suite 12.2.3 through 12.2.11. An attacker with HTTP access can reach vulnerable Web ADI upload functionality without valid credentials and compromise the component, potentially leading to attacker-controlled uploads, application-tier execution, data access, data modification, and service disruption with the privileges available to the E-Business Suite application tier.

Why it matters to the business

This vulnerability can allow an external attacker to take over a key Oracle E-Business Suite component without logging in, creating risk of financial, HR, procurement, or operational data theft or manipulation, business application outage, fraud, and ransomware deployment. It is listed in CISA KEV, has been actively exploited in the wild, is associated with ransomware activity, has a very high EPSS likelihood of exploitation, and the CISA remediation deadline of 2023-02-23 has long passed, so unpatched internet-accessible systems should be treated as urgent exposure.

How an attack unfolds

An attacker first identifies an Oracle E-Business Suite instance exposing Web Applications Desktop Integrator endpoints over HTTP or HTTPS. They then send crafted unauthenticated requests to the vulnerable upload functionality, bypassing the normal login requirement. If successful, the attacker can abuse the upload workflow to take control of the Web ADI component and may place attacker-controlled content on the application tier, invoke application functionality, or pivot toward code execution depending on system configuration. After gaining a foothold, an attacker commonly attempts to enumerate E-Business Suite data, harvest credentials or session material, deploy web shells or persistence, stage tools, move laterally, exfiltrate sensitive business data, and, in ransomware-driven intrusions, encrypt or disrupt dependent systems. Public reporting and KEV status indicate active exploitation, including ransomware-associated activity, so exploitation attempts should be expected against exposed systems.

How to fix it

Apply the Oracle Critical Patch Update that fixes this issue, or a later supported Oracle E-Business Suite security patch level, to all affected Oracle E-Business Suite 12.2.3 through 12.2.11 environments. If immediate patching is not possible, reduce exposure by removing direct internet access to Oracle E-Business Suite, restricting /OA_HTML/ and Web ADI access to trusted networks or VPN, enforcing WAF rules that block unauthenticated access to Web ADI upload-related endpoints, disabling Web Applications Desktop Integrator functionality where business-acceptable, and monitoring for upload abuse. Because this vulnerability is in CISA KEV and associated with ransomware, patching should be treated as emergency work for any externally reachable instance. After remediation, rotate potentially exposed application, database, and administrative credentials if compromise is suspected, review application-tier file integrity, and validate that no attacker-created files or persistence remain.

How to confirm the fix worked

Confirm the Oracle E-Business Suite version and applied Oracle CPU/security patches on every instance, including non-production and disaster-recovery systems. Validate that affected versions 12.2.3 through 12.2.11 have received the relevant Oracle E-Business Suite security fixes or have been upgraded to a patched supported level. From an unauthenticated network location, requests to Web ADI upload functionality should be rejected, redirected to authentication, or blocked; they should not process uploads or return successful application responses. Review web-tier routing, WAF, reverse proxy, and load balancer rules to ensure vulnerable endpoints are not directly exposed to the internet. Perform file integrity checks on the E-Business Suite application tier, especially web-accessible directories, and compare against a known-good baseline. If exploitation is suspected, validate remediation only after completing incident response, removing unauthorized files, and rotating credentials.

Typical attack path

1. Scan the internet or target network for exposed Oracle E-Business Suite web interfaces, commonly under /OA_HTML/.
2. Fingerprint the application version or probe for Web Applications Desktop Integrator upload endpoints.
3. Send crafted unauthenticated HTTP requests to the vulnerable upload component to bypass authentication.
4. Use the upload functionality to introduce attacker-controlled content or gain control of the Web ADI component.
5. Attempt to execute commands, deploy a web shell, or abuse application-tier privileges where possible.
6. Access, export, or modify sensitive E-Business Suite business data.
7. Establish persistence, collect credentials, move laterally, and stage additional tooling.
8. Exfiltrate data and, in ransomware campaigns, deploy encryption or destructive payloads.

How to detect it

Review historical web server, reverse proxy, load balancer, WAF, and Oracle E-Business Suite application logs for unauthenticated requests to Web Applications Desktop Integrator upload-related paths, especially POST requests under /OA_HTML/ that returned HTTP 200, 201, 302 followed by successful access, or unusually large responses. Look for requests containing BneUploaderService, BneViewerXMLService, BneDownloadService, bne:uueupload, multipart upload content, encoded payloads, path traversal sequences, or unusual user agents. Correlate suspicious web requests with new or modified files in web-accessible Oracle E-Business Suite directories, particularly unexpected JSP, class, XML, ZIP, UUE, or temporary upload files. On the application tier, review EDR and OS logs for Java, OACore, WebLogic, or Oracle application processes spawning shells or utilities such as sh, bash, cmd.exe, powershell.exe, curl, wget, certutil, python, perl, nc, or ncat. Review outbound network telemetry for new connections from the E-Business Suite application tier to unfamiliar external hosts shortly after suspicious upload activity. Check database and application audit logs for unusual high-volume exports, account creation, privilege changes, integration changes, or access to sensitive business data following suspicious HTTP activity. Because exploitation has been observed in the wild and associated with ransomware, also search for data staging archives, ransomware notes, encryption tooling, and lateral movement activity originating from the application tier.

• /OA_HTML/BneUploaderService
• /OA_HTML/BneViewerXMLService
• /OA_HTML/BneDownloadService
• BneUploaderService
• BneViewerXMLService
• BneDownloadService
• bne:uueupload
• POST /OA_HTML/
• multipart/form-data
• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2E%2E%2F
• .jsp
• cmd.exe /c
• /bin/sh -c
• /bin/bash -c
• powershell.exe
• certutil.exe
• curl
• wget
• ncat
• nc -e

What your security team should do

• Immediately identify all Oracle E-Business Suite instances, including externally exposed, internal, test, clone, and disaster-recovery environments.
• Prioritize emergency patching for all affected Oracle E-Business Suite 12.2.3 through 12.2.11 systems, especially any reachable from the internet.
• Until patching is complete, restrict access to Oracle E-Business Suite and Web ADI endpoints to trusted networks or VPN and enforce compensating WAF controls.
• Hunt historical web, application, proxy, WAF, EDR, and file-system telemetry for unauthenticated access to Web ADI upload endpoints and suspicious file creation under web-accessible directories.
• Treat confirmed vulnerable internet-facing systems as potentially compromised because the issue is KEV-listed, actively exploited, high-EPSS, and associated with ransomware.
• Check for web shells, unexpected JSP/class files, suspicious child processes spawned by the Java application tier, outbound connections, credential dumping, and data staging.
• Rotate credentials and invalidate sessions if exploitation is suspected or confirmed, including application, database, integration, and administrative accounts.
• Preserve logs and forensic images before cleanup where incident response or legal requirements apply.
• Add SIEM detections for Web ADI upload endpoint access, suspicious /OA_HTML/ POST requests, and application-tier process execution anomalies.
• Review whether Web Applications Desktop Integrator is required; disable or tightly restrict it where business use is limited.