CVE-2024-35155
📋 TL;DR
IBM MQ Console versions 9.3 LTS and 9.3 CD expose detailed technical error messages to remote attackers, potentially revealing sensitive system information. This information disclosure vulnerability could provide attackers with intelligence for further attacks against the system. Organizations running affected IBM MQ Console versions are at risk.
💻 Affected Systems
- IBM MQ Console
📦 What is this software?
Mq by Ibm
Mq by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain detailed system information, configuration details, or internal paths that enable targeted follow-up attacks, potentially leading to full system compromise.
Likely Case
Attackers gather reconnaissance data about the IBM MQ environment, including version information, internal paths, and configuration details that could inform subsequent attacks.
If Mitigated
Limited information disclosure with no sensitive credentials or critical configuration data exposed, reducing the attack surface for follow-up exploitation.
🎯 Exploit Status
Exploitation requires triggering error conditions that return detailed technical messages to the browser
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply IBM MQ 9.3.0.15 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7158059
Restart Required: Yes
Instructions:
1. Download IBM MQ 9.3.0.15 or later from IBM Fix Central. 2. Apply the fix pack following IBM's installation procedures. 3. Restart the IBM MQ Console service.
🔧 Temporary Workarounds
Disable Detailed Error Messages
allConfigure IBM MQ Console to return generic error messages instead of detailed technical information
Configure error handling in IBM MQ Console configuration files to suppress detailed error messages
Network Segmentation
allRestrict access to IBM MQ Console to trusted internal networks only
Configure firewall rules to limit access to IBM MQ Console ports (typically 9443)
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to filter error messages containing technical details
- Monitor and alert on unusual error message patterns in IBM MQ Console logs
🔍 How to Verify
Check if Vulnerable:
Check IBM MQ Console version via administrative interface or configuration filesCheck Version:
dspmqver (on IBM MQ server) or check version in MQ Console web interfaceVerify Fix Applied:
Verify installed version is 9.3.0.15 or later and test that error conditions return generic messages📡 Detection & Monitoring
Log Indicators:
- Unusual error patterns in IBM MQ Console logs
- Multiple error requests from single sources
Network Indicators:
- Unusual traffic patterns to IBM MQ Console error endpoints
- Repeated requests designed to trigger errors
SIEM Query:
source="ibm_mq_console" AND (message="*error*" OR message="*exception*") AND message="*detailed*"