CVE-2024-49344
📋 TL;DR
IBM OpenPages with Watson versions 8.3 and 9.0 have a session management vulnerability where chat sessions remain active after user logout. This allows potential unauthorized access to chat functionality if an attacker gains access to the session. Organizations using these versions with the Watson Assistant chat feature enabled are affected.
💻 Affected Systems
- IBM OpenPages with Watson
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could hijack an active chat session after legitimate user logout, potentially accessing sensitive chat history or impersonating the user in chat interactions.
Likely Case
Unauthorized access to chat sessions could lead to information disclosure of chat conversations or unauthorized use of chat functionality.
If Mitigated
With proper network segmentation and access controls, the impact is limited to chat functionality only, not core application data.
🎯 Exploit Status
Exploitation requires access to the chat session after legitimate user logout. No authentication bypass is involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply interim fix or upgrade as specified in IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/7183541
Restart Required: Yes
Instructions:
1. Review IBM advisory for specific patch details. 2. Apply the interim fix or upgrade to patched version. 3. Restart the application. 4. Verify chat sessions are properly terminated on logout.
🔧 Temporary Workarounds
Disable Watson Assistant Chat Feature
allTemporarily disable the vulnerable chat functionality until patching can be completed
Consult IBM documentation for disabling Watson Assistant chat feature
🧯 If You Can't Patch
- Implement session timeout policies for chat sessions
- Monitor chat session activity logs for anomalies
🔍 How to Verify
Check if Vulnerable:
Check if running IBM OpenPages with Watson 8.3 or 9.0 with Watson Assistant chat feature enabledCheck Version:
Check application version in IBM OpenPages administration consoleVerify Fix Applied:
Test that chat sessions are properly terminated when users log out📡 Detection & Monitoring
Log Indicators:
- Chat sessions continuing after user logout events
- Multiple chat sessions from same user ID with overlapping timestamps
Network Indicators:
- Chat API calls from unexpected IP addresses after logout
SIEM Query:
source="openpages" AND event="logout" AND chat_session_active="true"