CVE-2023-40694
📋 TL;DR
IBM Watson CP4D Data Stores versions 4.0.0 through 4.8.4 store sensitive information in log files that could be read by local users. This information disclosure vulnerability allows attackers with local access to potentially obtain credentials or other sensitive data. Organizations using affected versions of IBM Watson CP4D Data Stores are impacted.
💻 Affected Systems
- IBM Watson CP4D Data Stores
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attackers obtain administrative credentials or other highly sensitive data from logs, leading to full system compromise or data exfiltration.
Likely Case
Local users or attackers with basic access read sensitive configuration details, API keys, or partial credentials from log files.
If Mitigated
With proper access controls and log file permissions, only authorized administrators can access logs, limiting exposure.
🎯 Exploit Status
Exploitation requires local access to read log files. No authentication bypass is needed if the attacker already has local user access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.5 and later
Vendor Advisory: https://www.ibm.com/support/pages/node/7150286
Restart Required: Yes
Instructions:
1. Upgrade IBM Watson CP4D Data Stores to version 4.8.5 or later. 2. Apply the fix through the IBM Cloud Pak for Data administration console. 3. Restart the Data Stores service after patching.
🔧 Temporary Workarounds
Restrict log file permissions
linuxSet strict file permissions on log directories to prevent unauthorized local users from reading sensitive logs.
chmod 600 /path/to/cp4d/logs/*
chown root:root /path/to/cp4d/logs/*
Enable log redaction
allConfigure IBM Watson CP4D to redact sensitive information from logs before writing them.
🧯 If You Can't Patch
- Implement strict access controls on log directories to limit read access to authorized administrators only.
- Regularly monitor and audit log file access to detect unauthorized reading attempts.
🔍 How to Verify
Check if Vulnerable:
Check the IBM Watson CP4D Data Stores version via the administration console or command: `oc get pods -n <namespace> -l app=cp4d-datastores` and verify version is between 4.0.0 and 4.8.4.Check Version:
oc get pods -n <namespace> -l app=cp4d-datastores -o jsonpath='{.items[*].metadata.labels.version}'Verify Fix Applied:
Confirm version is 4.8.5 or later using the same command, and verify log files no longer contain sensitive information in plain text.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to log files
- Log entries containing sensitive data like passwords or API keys
Network Indicators:
- None - this is a local information disclosure vulnerability
SIEM Query:
source="cp4d_logs" AND (event="file_access" AND file_path="*log*" AND user NOT IN ["authorized_users"])