CVE-2025-13379
📋 TL;DR
CVE-2025-13379 is a SQL injection vulnerability in IBM Aspera Console versions 3.4.0 through 3.4.8 that allows remote attackers to execute arbitrary SQL commands. This could enable attackers to read, modify, or delete data in the backend database. Organizations running affected versions of IBM Aspera Console are vulnerable.
💻 Affected Systems
- IBM Aspera Console
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the database including data theft, data destruction, and potential lateral movement to connected systems.
Likely Case
Data exfiltration of sensitive information stored in the Aspera Console database, potentially including user credentials and file transfer metadata.
If Mitigated
Limited impact if proper network segmentation, database permissions, and input validation controls are in place.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, especially when unauthenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.9 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7259448
Restart Required: Yes
Instructions:
1. Download IBM Aspera Console version 3.4.9 or later from IBM Fix Central. 2. Backup current configuration and data. 3. Stop Aspera Console services. 4. Install the updated version. 5. Restart services and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Aspera Console to only trusted IP addresses and networks.
Web Application Firewall
allDeploy a WAF with SQL injection protection rules in front of Aspera Console.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor database logs for unusual SQL query patterns
🔍 How to Verify
Check if Vulnerable:
Check Aspera Console version via web interface or configuration files. Versions 3.4.0 through 3.4.8 are vulnerable.Check Version:
Check web interface or consult Aspera Console documentation for version checking method.Verify Fix Applied:
Verify installed version is 3.4.9 or later and test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts with SQL-like payloads
Network Indicators:
- HTTP requests containing SQL keywords to Aspera Console endpoints
SIEM Query:
source="aspera_console" AND (http_uri="*SELECT*" OR http_uri="*UNION*" OR http_uri="*INSERT*" OR http_uri="*DELETE*")