CVE-2024-20953

What it actually does

CVE-2024-20953 is a remotely reachable Oracle Agile PLM vulnerability in the Export component that allows a low-privileged authenticated attacker to compromise the application over HTTP. The issue is assessed as remote code execution / application takeover with high confidentiality, integrity, and availability impact. Because exploitation requires only network access and a low-privileged account, an attacker who obtains or creates minimal Agile PLM credentials may be able to execute attacker-controlled actions in the context of the Agile PLM application, access sensitive product lifecycle data, alter records or workflows, and disrupt service availability.

Why it matters to the business

Successful exploitation can result in full takeover of Oracle Agile PLM, a system that commonly stores sensitive product designs, bills of materials, supplier information, engineering changes, and manufacturing workflows. The business impact can include theft of intellectual property, manipulation of product or supply-chain data, interruption of engineering and manufacturing operations, and potential downstream integrity issues in dependent business processes. This vulnerability is listed in CISA KEV with a remediation due date of 2025-03-17 and is reported as actively exploited in the wild, so exposed or unpatched deployments should be treated as urgent even though the EPSS score is moderate.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable Oracle Agile PLM deployment and authenticates with a low-privileged account. The attacker then sends crafted HTTP requests to vulnerable Export functionality. Because the flaw is associated with unsafe server-side handling of attacker-controlled data, the request can trigger unintended execution or application compromise in the Agile PLM server context. After successful exploitation, the attacker may establish persistence, deploy a web shell or other post-exploitation tooling, enumerate Agile PLM users and roles, export sensitive PLM data, modify business records, or use the application server as a foothold for lateral movement. Active exploitation has been observed in the wild, so defenders should assume attackers may pair this vulnerability with credential theft, web shell deployment, and Java application server post-exploitation techniques.

How to fix it

Apply the Oracle Critical Patch Update or vendor-provided fix that addresses CVE-2024-20953 for Oracle Agile PLM 9.3.6. If exact fixed build information is not already tracked internally, verify the currently installed Agile PLM patch level against the relevant Oracle security advisory and Oracle Support documentation. Because this vulnerability is in CISA KEV and actively exploited, prioritize patching over compensating controls. Until patching is complete, restrict network access to Agile PLM to trusted administrative and business networks, enforce strong authentication and MFA where supported, disable or tightly limit unnecessary Export functionality if operationally feasible, review and reduce low-privileged account access, block direct internet exposure, and monitor the application for suspicious export activity, unexpected child processes, and new web-accessible files. After patching, rotate credentials that may have been exposed and review application/service account privileges.

How to confirm the fix worked

Confirm the installed Oracle Agile PLM version and patch level from the application administration interface, deployment inventory, file manifests, or Oracle OPatch/vendor patch records, and verify it includes the fix for CVE-2024-20953. Validate that no unsupported or unpatched Oracle Agile PLM 9.3.6 instances remain reachable from untrusted networks. From a defensive testing perspective, confirm the vulnerable Export paths are no longer susceptible using an approved vulnerability scanner or vendor-safe detection method; avoid running public exploit code against production systems. Review access controls to ensure only authorized users can reach Export functionality. Validate that application servers do not spawn unexpected operating-system shells or interpreters during normal export operations. Confirm compensating controls such as WAF rules, network ACLs, VPN restrictions, and authentication requirements are in place where patching cannot be completed immediately.

Typical attack path

1. Identify an Oracle Agile PLM 9.3.6 deployment reachable over HTTP or HTTPS.
2. Obtain or use a low-privileged Agile PLM account through credential theft, password spraying, reuse, phishing, or existing access.
3. Send crafted requests to the vulnerable Export component.
4. Trigger server-side compromise in the Oracle Agile PLM application context.
5. Execute commands or application actions with the privileges of the Agile PLM service account or application runtime.
6. Deploy persistence such as a web shell, malicious JSP, scheduled task, or unauthorized application user.
7. Access, export, or modify PLM data including product records, files, workflows, supplier data, or engineering change information.
8. Use the compromised application server for credential harvesting, internal reconnaissance, or lateral movement.

How to detect it

Look for evidence of exploitation across HTTP access logs, reverse proxy/WAF logs, Oracle Agile PLM application logs, WebLogic or Java application server logs, operating-system process telemetry, EDR alerts, and file integrity monitoring. Focus on authenticated low-privileged users making unusual or repeated requests to Export functionality, requests with abnormal payload size or encoded binary data, unexpected HTTP 500 errors around export operations, Java deserialization-related exceptions, and successful export activity followed by process execution or file creation. On the host, investigate any Java or WebLogic process spawning operating-system shells, PowerShell, cmd.exe, sh, bash, Python, Perl, curl, wget, certutil, bitsadmin, nc, or similar utilities. Search web application directories and temporary directories for newly created JSP, WAR, CLASS, JAR, or script files. Review Agile PLM user administration records for newly created users, privilege escalation, role changes, and abnormal login patterns. Because exploitation is active in the wild, correlate suspicious export requests with subsequent data downloads, database access spikes, outbound network connections, and authentication events from the same account or source IP.

• CVE-2024-20953
• /Export
• ExportServlet
• java.io.ObjectInputStream
• java.io.StreamCorruptedException
• java.io.InvalidClassException
• java.io.OptionalDataException
• java.lang.ClassNotFoundException
• java.lang.reflect.InvocationTargetException
• weblogic.servlet.jsp.JspStub
• cmd.exe /c
• powershell.exe
• /bin/sh -c
• /bin/bash -c
• curl
• wget
• certutil.exe
• bitsadmin.exe
• .jsp
• .war
• .class
• .jar

What your security team should do

• Treat this as a high-priority remediation item because it is in CISA KEV, has active exploitation reported, and can lead to full Oracle Agile PLM takeover.
• Inventory all Oracle Agile PLM deployments, including internal, internet-facing, disaster recovery, and legacy instances, and identify any running affected 9.3.6 builds.
• Apply the relevant Oracle security patch or CPU for Agile PLM immediately and verify patch success from authoritative version and patch records.
• Remove direct internet exposure where possible; place Agile PLM behind VPN, ZTNA, or tightly scoped allowlists.
• Review all low-privileged Agile PLM accounts for suspicious creation, recent privilege changes, abnormal login locations, or unusual export volume.
• Hunt for exploitation before and after patching using web access logs, Agile PLM application logs, Java application server logs, EDR telemetry, and file integrity monitoring.
• Investigate any Java application server process spawning shells, script interpreters, archive utilities, network utilities, or credential-dumping tools.
• Search for newly created JSP, WAR, class, or script files in Agile PLM and application server web directories.
• Rotate credentials for Agile PLM service accounts, administrator accounts, integration accounts, and database accounts if compromise is suspected.
• Preserve logs and forensic images for systems showing exploitation indicators, because successful exploitation may involve data theft or application-level persistence.