CVE-2021-2054

Vulnerability

An improper privilege management vulnerability exists in the RDBMS Sharding component of Oracle Database Server, affecting versions 12.2.0.1, 18c, and 19c. The flaw resides within the execution of stored procedures, where the process does not properly verify the caller's privileges [1]. An attacker must have high privileges (Create Any Procedure, Create Any View, or Create Any Trigger) and network access via Oracle Net to reach the vulnerable code path.

Exploitation

An attacker with high privileges and network access can exploit this flaw by executing a specially crafted stored procedure that bypasses privilege checks [1]. The ZDI advisory notes that authentication is required and the attack complexity is low, requiring no user interaction [1]. The specific sequence involves invoking a malicious or manipulated procedure that leverages the insufficient privilege validation to gain unauthorized access to resources.

Impact

Successful exploitation results in a complete takeover of RDBMS Sharding, with high impacts on confidentiality, integrity, and availability (CVSS 3.1 Base Score 7.2, vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) [1]. The attacker gains the ability to read, modify, or destroy sensitive shard data and potentially compromise the entire sharded database environment.

Mitigation

Oracle released a security patch for this vulnerability in its Critical Patch Update for January 2021. Affected users should apply the patch for their respective Oracle Database versions (12.2.0.1, 18c, 19c) as soon as possible. No workarounds are provided; patching is the only mitigation [1].