CVE DatabaseCVE-2022-21587

Updated 2026-06-17한국어 권고문 →

CVE-2022-215879.8/CRITICALCISA KEVCWE-306CWE-306

Oracle E-Business Suite Web Applications Desktop Integrator Remote Code Execution Vulnerability (CVE-2022-21587) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

e-business suite, web applications desktop integrator

Published Date

2022-10-18

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

98.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.11, specifically the Upload component of Web Applications Desktop Integrator.

Impact

Unauthenticated remote attackers can exploit this vulnerability via HTTP to upload arbitrary files and achieve full system takeover (RCE).

Mitigation

Immediately apply the official Oracle Critical Patch Update (CPU) patches and restrict external access to vulnerable endpoints.

Affected Products & Version Scope

Oracle E-Business Suite (EBS) versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, and 12.2.11

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official patches provided in the Oracle Critical Patch Update (CPU) for October 2022 or later. Use the ADOP (Active Delta Online Patching) utility to apply the patch set.

bash

# 1. Load the EBS environment variables
source /u01/install/APPS/EBSapps.env run

# 2. Apply the patch using ADOP phases (replace patch number with the appropriate CPU patch)
adop phase=prepare
adop phase=apply patches=34382213
adop phase=finalize
adop phase=cutover
adop phase=cleanup

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, restrict access to the vulnerable upload endpoints using a reverse proxy or Web Application Firewall (WAF).

nginx

# Block access to BneUploaderService and related endpoints in Nginx configuration
server {
    listen 80;
    server_name ebs.example.com;

    location ~* /OA_HTML/(BneUploaderService|BneViewerService) {
        deny all;
        return 403 'Access Denied: Unauthorized Upload Attempt';
    }
}

3. Log Audit & IoC Verification Commands

Inspect web server access logs and the filesystem for unauthorized upload attempts and suspicious JSP files.

bash

# 1. Search access logs for BneUploaderService requests returning 200 OK
grep -i 'BneUploaderService' /u01/install/APPS/fs_ne/inst/log/apaches/*.log | grep ' 200 '

# 2. Scan the OA_HTML directory for recently created or modified JSP files
find /u01/install/APPS/fs1/FMW_Home/webtier/instances/*/config/OHS/ohs1/htdocs/OA_HTML/ -name '*.jsp' -mtime -30 -ls

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild (CISA KEV), immediately apply the Oracle CPU October 2022 patch and restrict external access to EBS upload endpoints.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-21587) is a critical authentication bypass and arbitrary file upload flaw within the 'Upload' component of the Oracle Web Applications Desktop Integrator in Oracle E-Business Suite (EBS). The root cause lies in the application's failure to properly validate file uploads and enforce authentication checks (CWE-306) on specific upload servlets, allowing unauthenticated network-based attackers to write arbitrary files to the server's filesystem.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by sending a crafted HTTP POST request to the vulnerable upload endpoint (such as /OA_HTML/BneUploaderService) without requiring any credentials. The payload typically consists of a multipart form-data request containing a malicious ZIP archive. Inside this archive, a JSP web shell is embedded. Due to insecure archive extraction handling on the server side, the application extracts the contents into the web-accessible directory (/OA_HTML/). The attacker then accesses the uploaded JSP file directly via HTTP, executing arbitrary operating system commands with the privileges of the application server.

3. Infrastructure & Business Impact

With a CVSS 3.1 base score of 9.8, this vulnerability poses an extreme risk and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. Successful exploitation allows complete takeover of the Oracle Web Applications Desktop Integrator and the underlying EBS infrastructure. This can lead to unauthorized access to sensitive business data (financials, HR, supply chain), database tampering, deployment of ransomware, and lateral movement within the corporate network.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html

Source: secalert_us@oracle.com · Exploit, Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpuoct2022.html

Source: secalert_us@oracle.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpuoct2022.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2022-21587)

FAQ

Q1. How critical is CVE-2022-21587 and is it actively exploited in the wild?

CVE-2022-21587 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-21587?

Primary impacted vendors include oracle across e-business suite, web applications desktop integrator. Scope summary: Oracle E-Business Suite (EBS) versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, and 12.2.11

Q3. What temporary mitigations or workarounds exist for CVE-2022-21587 before patching?

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) patches and restrict external access to vulnerable endpoints. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION