CVE-2024-45643
📋 TL;DR
IBM Security QRadar 3.12 EDR uses weak cryptographic algorithms that could allow attackers to decrypt stored credential information. This affects organizations using vulnerable versions of QRadar EDR, potentially exposing administrative credentials and sensitive data.
💻 Affected Systems
- IBM Security QRadar EDR
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to QRadar EDR, potentially compromising the entire security monitoring infrastructure and accessing sensitive security data.
Likely Case
Attackers decrypt stored credentials to gain unauthorized access to QRadar EDR systems, potentially modifying security policies or accessing sensitive security data.
If Mitigated
Limited impact if strong network segmentation and access controls prevent attackers from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires access to encrypted credential storage and knowledge of weak cryptographic implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fix as per IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/7185938
Restart Required: Yes
Instructions:
1. Review IBM advisory 2. Download and apply the fix from IBM Fix Central 3. Restart QRadar EDR services 4. Verify cryptographic algorithms have been updated
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to QRadar EDR systems to authorized management networks only
Credential Rotation
allRotate all credentials stored in QRadar EDR to limit exposure window
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach QRadar EDR systems
- Monitor for unusual authentication attempts or credential access patterns
🔍 How to Verify
Check if Vulnerable:
Check QRadar EDR version via QRadar console or command line; version 3.12 is vulnerableCheck Version:
qradar_edr_version_check or check via QRadar administration consoleVerify Fix Applied:
Verify fix has been applied through QRadar administration interface and check cryptographic algorithms in use📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed credential decryption attempts
- Unauthorized access to credential storage
Network Indicators:
- Unusual network traffic to QRadar EDR credential storage locations
- Suspicious outbound connections from QRadar EDR systems
SIEM Query:
source="QRadar_EDR" AND (event_type="authentication_failure" OR event_type="credential_access")