CVE-2020-4779
📋 TL;DR
This HTTP Verb Tampering vulnerability in IBM Curam Social Program Management allows attackers to bypass security access controls by sending specially crafted HTTP requests. It affects IBM Curam Social Program Management versions 7.0.9 and 7.0.10, potentially enabling unauthorized access to protected resources.
💻 Affected Systems
- IBM Curam Social Program Management
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through unauthorized administrative access, data exfiltration, or service disruption.
Likely Case
Unauthorized access to sensitive data or functionality that should be protected by access controls.
If Mitigated
Limited impact with proper network segmentation, monitoring, and authentication controls in place.
🎯 Exploit Status
HTTP verb tampering typically requires minimal technical skill but specific exploitation details are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply interim fix or upgrade as per IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/6346579
Restart Required: Yes
Instructions:
1. Review IBM advisory 2. Apply recommended interim fix 3. Restart application services 4. Verify fix implementation
🔧 Temporary Workarounds
Web Application Firewall Rules
allConfigure WAF to block or alert on unusual HTTP verb usage patterns
Network Segmentation
allRestrict access to Curam application to authorized networks only
🧯 If You Can't Patch
- Implement strict network access controls and monitor for unusual HTTP traffic patterns
- Enhance authentication and authorization logging to detect access control bypass attempts
🔍 How to Verify
Check if Vulnerable:
Test with HTTP verb manipulation tools or review application logs for unusual verb usageCheck Version:
Check Curam application version through administrative interface or configuration filesVerify Fix Applied:
Verify patch installation and test that HTTP verb tampering no longer bypasses controls📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP verbs (PUT, DELETE, TRACE, etc.) in access logs
- Failed authentication followed by successful access with different HTTP method
Network Indicators:
- HTTP requests with non-standard verbs to Curam endpoints
- Rapid verb switching in request patterns
SIEM Query:
source="web_logs" AND (http_method="PUT" OR http_method="DELETE" OR http_method="TRACE") AND uri CONTAINS "/curam/"