CVE-2022-24047
📋 TL;DR
CVE-2022-24047 is an authentication bypass vulnerability in BMC Track-It! that allows remote attackers to access protected functionality without credentials. This affects installations of BMC Track-It! 20.21.01.102 where the system is exposed to untrusted networks.
💻 Affected Systems
- BMC Track-It!
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Track-It! system allowing attackers to access, modify, or delete sensitive data, escalate privileges, or pivot to other systems.
Likely Case
Unauthorized access to sensitive information, configuration changes, or service disruption.
If Mitigated
Limited impact if system is isolated behind strong network controls and access restrictions.
🎯 Exploit Status
The vulnerability requires no authentication and has a simple exploitation path. While no public PoC exists, the nature of the vulnerability makes weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply the security patch from BMC
Vendor Advisory: https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
Restart Required: Yes
Instructions:
1. Download the security patch from BMC support portal. 2. Apply the patch following BMC's installation instructions. 3. Restart the Track-It! service. 4. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Track-It! to only trusted IP addresses
Use firewall rules to restrict access to Track-It! port (default 80/443) to authorized IPs only
Web Application Firewall
allDeploy WAF with rules to detect and block authentication bypass attempts
Configure WAF rules to monitor for unusual authentication patterns and unauthorized access attempts
🧯 If You Can't Patch
- Isolate the Track-It! system behind a firewall with strict IP-based access controls
- Implement network segmentation to limit the system's exposure and potential lateral movement
🔍 How to Verify
Check if Vulnerable:
Check if Track-It! version is 20.21.01.102. If yes, assume vulnerable unless patched.Check Version:
Check Track-It! web interface or administration console for version informationVerify Fix Applied:
Verify the patch is applied by checking version information in Track-It! administration panel and confirming with BMC support.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to protected endpoints
- Authentication bypass patterns in web server logs
- Access to admin functions from unauthenticated IPs
Network Indicators:
- HTTP requests to protected endpoints without authentication headers
- Unusual access patterns to Track-It! web interface
SIEM Query:
source="track-it-logs" AND (event_type="auth_failure" OR event_type="unauthorized_access") AND status="200"