CVE-2022-21587
Oracle E-Business Suite Unspecified Vulnerability
Description
CVE-2022-21587 is a critical unauthenticated remote code execution vulnerability in Oracle Web Applications Desktop Integrator, a component of Oracle E-Business Suite. The flaw resides in the Upload component and allows an unauthenticated attacker with network access via HTTP to completely compromise affected installations. Supported versions 12.2.3 through 12.2.11 are affected. With a CVSS v3.1 score of 9.8 and an EPSS score of 94.4% (99.97th percentile), this vulnerability represents a severe threat to organizations running Oracle E-Business Suite. CISA has added CVE-2022-21587 to the Known Exploited Vulnerabilities catalog and identified it as a known ransomware attack vector, underscoring the urgency of applying Oracle's October 2022 Critical Patch Update.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | e-business suite | >= 12.2.3, <= 12.2.11 |
References
- http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpuoct2022.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2022-21587 is classified under CWE-306, which describes a weakness where a software system does not require authentication for accessing a critical function. In the case of Oracle Web Applications Desktop Integrator, the Upload component exposes functionality that should be restricted to authenticated users but fails to enforce proper authentication checks. This allows unauthenticated remote attackers to access the upload mechanism and leverage it to achieve full system compromise, including reading, modifying, and deleting data within the Oracle E-Business Suite environment.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2022-21587 carries a CVSS v3.1 score of 9.8 (Critical severity), representing near-maximum impact across all assessment dimensions. Attack Vector (Network): The vulnerability can be exploited remotely over HTTP, making any internet-exposed Oracle E-Business Suite instance a potential target. Attack Complexity (Low): No special conditions, timing, or preparation are required for successful exploitation. Privileges Required (None): The attack requires no authentication whatsoever, allowing any network-connected attacker to exploit the flaw. User Interaction (None): Exploitation is fully automated and requires no action from legitimate users. Scope (Unchanged): The impact is contained within the Oracle Web Applications Desktop Integrator component and its associated E-Business Suite instance. Confidentiality Impact (High), Integrity Impact (High), and Availability Impact (High) indicate that successful exploitation results in a complete takeover of the affected component, granting the attacker full access to read, modify, and delete all data managed by the Oracle E-Business Suite, which typically includes sensitive financial, procurement, and human resources information. The EPSS score of 94.4% (99.97th percentile) confirms extremely high exploitation probability. CISA has designated this as a known ransomware attack vector, indicating that threat actors have leveraged this vulnerability as part of ransomware operations targeting enterprise ERP systems.
Exploit Maturity
Public exploit code is available for CVE-2022-21587 via Packet Storm Security, demonstrating an unauthenticated arbitrary file upload attack path against Oracle E-Business Suite. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 23, 2023, confirming active exploitation in the wild. CVE-2022-21587 is a confirmed ransomware attack vector, with threat actors targeting Oracle E-Business Suite installations to gain initial access to enterprise environments containing high-value financial and operational data. The EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation probability, which is consistent with the critical severity, public exploit availability, and the high-value nature of Oracle ERP systems as targets for both ransomware operators and state-sponsored threat groups.
Remediation
- Apply Oracle's October 2022 Critical Patch Update immediately to address CVE-2022-21587 in Oracle Web Applications Desktop Integrator. This patch is available through Oracle's official security advisory and is required by CISA's KEV catalog directive, which mandates applying vendor mitigations or discontinuing use of the product by February 23, 2023.
- Verify that all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.11 are patched, including development, staging, and production environments. Unpatched non-production instances can serve as entry points for attackers to pivot into production networks.
- Restrict network access to Oracle E-Business Suite by ensuring the application is not directly exposed to the internet without proper security controls. Place the application behind a web application firewall (WAF) and restrict access to known, trusted IP ranges where possible.
- Monitor for indicators of compromise including unauthorized file uploads to the Web Applications Desktop Integrator component, unexpected HTTP requests to upload endpoints, anomalous database activity, and signs of data exfiltration from the E-Business Suite. Review web server and application logs for exploitation attempts.
- Conduct a thorough security assessment of the Oracle E-Business Suite environment, including reviewing all user accounts for unauthorized access, auditing database changes, and verifying the integrity of application files. Given the ransomware association, ensure offline backups of critical ERP data are available and tested.
Technical Details
CVE-2022-21587 is a missing authentication vulnerability (CWE-306) in the Upload component of Oracle Web Applications Desktop Integrator, which is part of the Oracle E-Business Suite. The Desktop Integrator provides functionality for users to work with Oracle E-Business Suite data through desktop applications, and the Upload component handles file submissions from client applications. The vulnerability exists because the Upload component does not properly enforce authentication checks on incoming requests, allowing an unauthenticated attacker to submit arbitrary file uploads via HTTP. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the most dangerous combination of metrics: network-accessible, low-complexity, unauthenticated exploitation with complete impact on confidentiality, integrity, and availability. Oracle E-Business Suite versions 12.2.3 through 12.2.11 are confirmed vulnerable. The unauthenticated file upload capability can be leveraged to upload malicious web shells or other executable content to the server, ultimately achieving remote code execution with the privileges of the Oracle E-Business Suite application service account. This grants the attacker access to the underlying database and all business data managed by the ERP system.
Frequently Asked Questions
Is CVE-2022-21587 being actively exploited?
Yes, CVE-2022-21587 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 23, 2023, and confirmed it as a ransomware attack vector. Public exploit code demonstrating unauthenticated arbitrary file upload is available, and the EPSS score of 94.4% (99.97th percentile) confirms extremely high exploitation activity.
What products are affected by CVE-2022-21587?
CVE-2022-21587 affects Oracle Web Applications Desktop Integrator, a component of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.11 are vulnerable. Any organization running these versions without Oracle's October 2022 Critical Patch Update applied is at risk.
How do I fix CVE-2022-21587?
Apply Oracle's October 2022 Critical Patch Update, which addresses this vulnerability in the Web Applications Desktop Integrator component. The patch is available through Oracle's official security advisory. If immediate patching is not possible, restrict network access to the Oracle E-Business Suite application and monitor for unauthorized file upload activity.
How severe is CVE-2022-21587?
CVE-2022-21587 has a CVSS v3.1 score of 9.8 (Critical severity), representing near-maximum risk. It enables unauthenticated remote attackers to completely compromise Oracle E-Business Suite installations, which typically contain sensitive financial, procurement, and HR data. The vulnerability is confirmed as a ransomware attack vector and has an EPSS score of 94.4% (99.97th percentile).
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.