CVE-2021-29844
📋 TL;DR
CVE-2021-29844 is a server-side request forgery (SSRF) vulnerability in IBM Jazz Team Server products that allows authenticated attackers to make unauthorized requests from the server. This could enable network scanning, internal service enumeration, or facilitate other attacks. Organizations using affected IBM Jazz products are vulnerable.
💻 Affected Systems
- IBM Jazz Team Server
- IBM Engineering Lifecycle Management
- IBM Rational Collaborative Lifecycle Management
- IBM Rational DOORS Next
- IBM Rational Engineering Lifecycle Manager
- IBM Rational Team Concert
- IBM Rational Quality Manager
📦 What is this software?
Engineering Lifecycle Optimization by Ibm
View all CVEs affecting Engineering Lifecycle Optimization →
Engineering Lifecycle Optimization by Ibm
View all CVEs affecting Engineering Lifecycle Optimization →
Engineering Lifecycle Optimization by Ibm
View all CVEs affecting Engineering Lifecycle Optimization →
Engineering Requirements Quality Assistant On Premises by Ibm
View all CVEs affecting Engineering Requirements Quality Assistant On Premises →
Rational Engineering Lifecycle Manager by Ibm
View all CVEs affecting Rational Engineering Lifecycle Manager →
Rational Engineering Lifecycle Manager by Ibm
View all CVEs affecting Rational Engineering Lifecycle Manager →
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to internal systems, exfiltrates sensitive data, or uses the server as a pivot point for lateral movement within the network.
Likely Case
Internal network enumeration, unauthorized access to internal services, or information disclosure about internal infrastructure.
If Mitigated
Limited impact due to network segmentation, proper authentication controls, and request filtering.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited. While no public PoC exists, the vulnerability type is well-understood and easily weaponized by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.2 iFix006, 6.0.6.1 iFix008, or later
Vendor Advisory: https://www.ibm.com/support/pages/node/6508583
Restart Required: Yes
Instructions:
1. Download appropriate iFix from IBM Fix Central. 2. Stop Jazz Team Server. 3. Apply iFix according to IBM instructions. 4. Restart Jazz Team Server. 5. Verify patch application.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from Jazz servers to only necessary services
Authentication Hardening
allImplement strong authentication controls and limit user privileges
🧯 If You Can't Patch
- Implement strict network egress filtering to limit what the Jazz server can access
- Monitor for unusual outbound requests from Jazz servers and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check Jazz Team Server version via administrative console or version.txt file. If version is 7.0, 7.0.1, 7.0.2, 6.0.6, or 6.0.6.1 without appropriate iFix, system is vulnerable.Check Version:
Check Jazz installation directory for version.txt or use administrative consoleVerify Fix Applied:
Verify version shows iFix006 (for 7.0.2) or iFix008 (for 6.0.6.1) applied. Check patch logs and verify no SSRF attempts succeed.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Jazz server
- Requests to internal IP ranges from Jazz application
- Multiple failed authentication attempts followed by SSRF patterns
Network Indicators:
- Jazz server making requests to unexpected internal services
- Port scanning activity originating from Jazz server IP
SIEM Query:
source="jazz_server" AND (url="http://internal*" OR url="https://internal*") AND method="GET|POST"