CVE-2024-10905: SailPoint IdentityIQ Info Disclosure Flaw

CVE-2024-10905 Overview

CVE-2024-10905 is a critical improper access control vulnerability affecting SailPoint IdentityIQ, a widely-used enterprise identity governance platform. The vulnerability allows unauthorized HTTP/HTTPS access to static content within the IdentityIQ application directory that should be protected. This flaw exposes sensitive resources to unauthenticated remote attackers, potentially compromising the confidentiality, integrity, and availability of the identity management infrastructure.

Critical Impact

This vulnerability enables unauthenticated remote attackers to access protected static content within the IdentityIQ application directory, potentially exposing sensitive configuration files, credentials, or other critical identity governance data.

Affected Products

• SailPoint IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2
• SailPoint IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5
• SailPoint IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8
• All SailPoint IdentityIQ versions prior to 8.2

Discovery Timeline

• 2024-12-02 - CVE-2024-10905 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2024-10905

Vulnerability Analysis

This vulnerability falls under CWE-66 (Improper Handling of File Names that Identify Virtual Resources), which relates to improper access control mechanisms in web applications. The core issue stems from inadequate protection of static content within the IdentityIQ application directory structure.

IdentityIQ serves as a centralized identity governance platform that manages user identities, access rights, and compliance across enterprise environments. The application contains various static resources including configuration files, templates, and potentially sensitive data assets. Due to this vulnerability, the access control mechanisms fail to properly restrict HTTP/HTTPS requests to these protected directories.

An attacker can exploit this vulnerability remotely without authentication by sending crafted HTTP/HTTPS requests directly to the application server. The vulnerability requires no privileges and no user interaction, making it particularly dangerous for internet-exposed IdentityIQ deployments.

Root Cause

The root cause of CVE-2024-10905 lies in improper access control configuration that fails to adequately protect static content within the IdentityIQ application directory. The application does not properly enforce authentication or authorization checks for certain file paths, allowing direct access to resources that should be restricted to authenticated users or administrators only.

This type of vulnerability typically occurs when web application security configurations do not properly map protection rules to all sensitive directories, or when URL rewriting rules inadvertently bypass security constraints. The affected versions of IdentityIQ lack proper enforcement of access restrictions on static resource paths.

Attack Vector

The attack vector for CVE-2024-10905 is network-based, requiring an attacker to have HTTP/HTTPS connectivity to the vulnerable IdentityIQ instance. The exploitation mechanism involves direct requests to specific application directory paths that should be protected but are inadvertently accessible.

An attacker would typically enumerate the IdentityIQ directory structure and attempt to access static content paths directly through the web server. Since no authentication is required, the attacker can retrieve protected resources by simply constructing appropriate HTTP requests to the vulnerable endpoints.

The vulnerability can be exploited remotely by sending direct HTTP/HTTPS requests to protected static content paths within the IdentityIQ application directory. Technical details regarding specific exploitation methods can be found in the SailPoint Security Advisory.

Detection Methods for CVE-2024-10905

Indicators of Compromise

• Unusual HTTP/HTTPS requests to static content directories within the IdentityIQ application path from external or unauthorized IP addresses
• Access log entries showing successful retrieval of protected static resources by unauthenticated sessions
• Anomalous directory traversal patterns or enumeration attempts targeting the IdentityIQ web application
• Unexpected data exfiltration patterns from the IdentityIQ server

Detection Strategies

• Monitor web server access logs for requests to protected IdentityIQ directories from unauthenticated sources
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized access attempts to static content paths
• Deploy network traffic analysis to identify reconnaissance or enumeration activity targeting IdentityIQ endpoints
• Use SentinelOne Singularity XDR to correlate endpoint and network indicators of potential exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the IdentityIQ application server and web server components
• Configure alerting for access attempts to sensitive static content directories without proper authentication
• Implement real-time monitoring of IdentityIQ server file system access patterns
• Regularly audit access logs for anomalous request patterns targeting application directories

How to Mitigate CVE-2024-10905

Immediate Actions Required

• Identify all SailPoint IdentityIQ instances in your environment and determine their current version and patch level
• Prioritize patching internet-exposed IdentityIQ deployments immediately due to the critical severity and network-based attack vector
• Implement network segmentation to restrict access to IdentityIQ instances while patches are being applied
• Review web server access logs for any evidence of prior exploitation attempts

Patch Information

SailPoint has released patches to address this vulnerability. Organizations should upgrade to the following minimum versions:

• IdentityIQ 8.4: Upgrade to version 8.4p2 or later
• IdentityIQ 8.3: Upgrade to version 8.3p5 or later
• IdentityIQ 8.2: Upgrade to version 8.2p8 or later
• Versions prior to 8.2: Upgrade to a supported patched version

Refer to the SailPoint Security Advisory for detailed patch information and upgrade instructions.

Workarounds

• Restrict network access to IdentityIQ instances using firewall rules to allow only authorized administrative IP ranges
• Implement a reverse proxy with additional authentication requirements in front of the IdentityIQ application
• Configure web server rules to explicitly deny access to sensitive static content directories
• Enable additional access controls at the web server level to require authentication for all application directory paths

# Example: Restrict access to IdentityIQ at the web server level (Apache)
# Add to httpd.conf or virtual host configuration
<Directory "/path/to/identityiq">
    Require all denied
    Require ip 10.0.0.0/8 192.168.0.0/16
</Directory>

# For Nginx, add to server block
location /identityiq {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}