CVE-2021-20380
📋 TL;DR
This vulnerability in IBM QRadar Advisor With Watson App allows remote attackers to obtain sensitive information from HTTP requests. The exposed information could aid in further attacks against the QRadar SIEM system. Affected users are those running IBM QRadar Advisor With Watson App versions 1.1 through 2.5 on IBM QRadar SIEM 7.4.
💻 Affected Systems
- IBM QRadar Advisor With Watson App
- IBM QRadar SIEM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain credentials or sensitive configuration data leading to full system compromise, lateral movement within the network, and data exfiltration.
Likely Case
Attackers gather information about system configuration, user accounts, or internal network details to plan targeted attacks against the QRadar environment.
If Mitigated
Information disclosure is limited to non-sensitive data due to proper network segmentation and access controls.
🎯 Exploit Status
The vulnerability allows information disclosure without authentication. While no public exploit code is confirmed, the nature of the vulnerability suggests exploitation would be straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QRadar Advisor With Watson App 2.6 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/6457941
Restart Required: Yes
Instructions:
1. Log into QRadar Console as administrator. 2. Navigate to Admin > Extensions Management. 3. Check for available updates for QRadar Advisor With Watson App. 4. Update to version 2.6 or later. 5. Restart the QRadar services as prompted.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to QRadar console and API endpoints to trusted IP addresses only.
Use firewall rules to limit access: iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate QRadar from untrusted networks
- Deploy web application firewall (WAF) rules to detect and block suspicious HTTP request patterns
🔍 How to Verify
Check if Vulnerable:
Check QRadar Advisor With Watson App version in QRadar Console under Admin > Extensions Management. If version is between 1.1 and 2.5 inclusive, the system is vulnerable.Check Version:
In QRadar Console: Admin > Extensions Management > View installed extensionsVerify Fix Applied:
Verify the app version shows 2.6 or higher in Extensions Management. Test that HTTP requests no longer leak sensitive information.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to QRadar Advisor endpoints from unauthorized sources
- Multiple failed authentication attempts followed by information disclosure requests
Network Indicators:
- Unusual traffic patterns to QRadar API endpoints from unexpected IP addresses
- HTTP requests that appear to be probing for information
SIEM Query:
SELECT * FROM events WHERE devicetype IN (SELECT id FROM referencedata WHERE name LIKE '%QRadar%') AND (category LIKE '%web%' OR category LIKE '%http%') AND (username IS NULL OR username='') AND (sourceip NOT IN (trusted_ips))