CVE-2024-45091
📋 TL;DR
IBM UrbanCode Deploy versions 7.0 through 7.2.3.13 store sensitive information in HTTP request logs that could be read by local users. This information disclosure vulnerability allows attackers with local access to potentially obtain credentials or other sensitive data. Organizations running affected UCD versions are at risk.
💻 Affected Systems
- IBM UrbanCode Deploy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attackers obtain administrative credentials or API keys from logs, leading to full system compromise, data theft, or unauthorized deployment actions.
Likely Case
Local users or compromised accounts access sensitive configuration data, authentication tokens, or deployment secrets from log files.
If Mitigated
With proper access controls and log file permissions, only authorized administrators can access logs, limiting exposure to trusted personnel.
🎯 Exploit Status
Exploitation requires local access to read log files; no special tools or techniques needed beyond file read permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.5.25, 7.1.2.11, 7.2.3.14 and later
Vendor Advisory: https://www.ibm.com/support/pages/node/7177857
Restart Required: Yes
Instructions:
1. Download appropriate fix pack from IBM Fix Central. 2. Backup current installation. 3. Stop UCD server. 4. Apply fix pack. 5. Restart UCD server. 6. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Restrict log file permissions
linuxSet strict file permissions on UCD log directories to prevent unauthorized access
chmod 600 /opt/ibm-ucd/server/logs/*.log
chown ucd:ucd /opt/ibm-ucd/server/logs/*.log
Enable log encryption/redaction
allConfigure UCD to encrypt or redact sensitive information in logs
🧯 If You Can't Patch
- Implement strict access controls on UCD server directories and log files
- Regularly monitor and audit access to UCD log files for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check UCD version via web interface or server.properties file; versions 7.0.5.24 and earlier, 7.1.2.10 and earlier, or 7.2.3.13 and earlier are vulnerable.Check Version:
grep 'version=' /opt/ibm-ucd/server/conf/server.propertiesVerify Fix Applied:
Verify UCD version is 7.0.5.25+, 7.1.2.11+, or 7.2.3.14+; check that sensitive data no longer appears in HTTP request logs.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to log directories
- Patterns of sensitive data exposure in log files
Network Indicators:
- N/A - local file access only
SIEM Query:
source="ucd_logs" AND (event_type="file_access" AND file_path="*logs/*.log") AND user!="authorized_admin"