CVE-2023-30995
📋 TL;DR
This vulnerability allows attackers to bypass IP whitelist restrictions in IBM Aspera Faspex by sending specially crafted HTTP requests. Affected organizations using Faspex for file transfers could have unauthorized access to their transfer systems. This impacts IBM Aspera Faspex versions 4.0-4.4.2 and 5.0-5.0.5.
💻 Affected Systems
- IBM Aspera Faspex
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized external actors gain access to file transfer systems, potentially exfiltrating sensitive data or uploading malicious files to internal networks.
Likely Case
Attackers bypass IP-based access controls to access file transfer functionality they shouldn't have, potentially viewing or intercepting file transfers.
If Mitigated
Attackers are blocked by additional authentication layers or network segmentation, limiting impact to the Faspex application only.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests but does not require authentication if IP whitelist is the only protection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.2 Patch Level 1 and 5.0.5 Patch Level 1
Vendor Advisory: https://www.ibm.com/support/pages/node/7029681
Restart Required: Yes
Instructions:
1. Download appropriate patch from IBM Fix Central. 2. Stop Aspera Faspex services. 3. Apply patch according to IBM instructions. 4. Restart services. 5. Verify patch application.
🔧 Temporary Workarounds
Network ACL Restriction
allImplement network-level access controls to restrict Faspex access to trusted IP ranges
Disable IP Whitelist Feature
allRemove IP whitelist configuration and rely on other authentication methods
🧯 If You Can't Patch
- Implement additional authentication layers (MFA, certificate-based auth)
- Isolate Faspex server in DMZ with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check Faspex version via admin interface or configuration files. Versions 4.0-4.4.2 and 5.0-5.0.5 without patches are vulnerable.Check Version:
Check Aspera Faspex web admin interface or configuration files for version informationVerify Fix Applied:
Verify patch is applied by checking version includes 'Patch Level 1' or higher in admin interface.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusual headers or parameters attempting to bypass restrictions
- Access from IP addresses outside whitelist ranges
Network Indicators:
- HTTP traffic to Faspex with crafted headers
- Unexpected source IPs accessing Faspex endpoints
SIEM Query:
source_ip NOT IN whitelist_ips AND destination_port=33001 AND http_user_agent CONTAINS 'Aspera'🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/254268
- https://www.ibm.com/support/pages/node/7029681
- https://www.ibm.com/support/pages/node/7048851
- https://exchange.xforce.ibmcloud.com/vulnerabilities/254268
- https://www.ibm.com/support/pages/node/7029681
- https://www.ibm.com/support/pages/node/7048851
