CVE-2024-28799
📋 TL;DR
IBM QRadar Suite and Cloud Pak for Security in non-default configurations improperly display sensitive data to local privileged users during back-end commands. This vulnerability allows privileged users on the system to view information that should remain hidden, potentially exposing credentials or configuration details. Affected versions are QRadar Suite 1.10.12.0-1.10.23.0 and Cloud Pak for Security 1.10.0.0-1.10.11.0.
💻 Affected Systems
- IBM QRadar Suite Software
- IBM Cloud Pak for Security
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privileged attacker obtains sensitive credentials or configuration data that could lead to lateral movement, privilege escalation, or compromise of other systems.
Likely Case
Authorized administrator accidentally views sensitive data during routine operations, potentially exposing credentials that could be misused.
If Mitigated
Minimal impact as only local privileged users in non-default configurations can access the data, and proper access controls limit exposure.
🎯 Exploit Status
Exploitation requires existing local privileged access to the system in a non-default configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QRadar Suite: 1.10.24.0 or later; Cloud Pak for Security: 1.10.12.0 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7165488
Restart Required: Yes
Instructions:
1. Download the appropriate fix pack from IBM Fix Central. 2. Follow IBM's installation guide for your product. 3. Apply the fix pack using the product's update mechanism. 4. Restart affected services as required.
🔧 Temporary Workarounds
Restrict Local Privileged Access
allLimit the number of users with local privileged access to affected systems.
Audit Configuration Settings
allReview and revert any non-default configurations that might trigger the vulnerability.
🧯 If You Can't Patch
- Implement strict access controls to limit local privileged users to only those who absolutely need it.
- Monitor privileged user activity and implement session logging for all administrative actions.
🔍 How to Verify
Check if Vulnerable:
Check your product version against affected ranges: QRadar Suite 1.10.12.0-1.10.23.0 or Cloud Pak for Security 1.10.0.0-1.10.11.0.Check Version:
For QRadar: Check Admin tab > System and License Management. For Cloud Pak: Use oc get pods to check container versions.Verify Fix Applied:
Verify version is QRadar Suite 1.10.24.0+ or Cloud Pak for Security 1.10.12.0+ and check that no sensitive data is displayed during back-end commands.📡 Detection & Monitoring
Log Indicators:
- Unusual privileged user activity
- Access to sensitive data files by local users
- Configuration changes to back-end command settings
Network Indicators:
- N/A - This is a local vulnerability
SIEM Query:
Search for privileged user sessions accessing sensitive configuration files or executing back-end commands that might trigger the disclosure.