CVE-2024-11604: OpenText IDM SCIM Driver Log Disclosure

CVE-2024-11604 Overview

CVE-2024-11604 is an Insertion of Sensitive Information into Log File vulnerability (CWE-532) affecting the SCIM Driver module in OpenText IDM Driver and Extensions. This vulnerability allows authenticated local users on Windows and Linux 64-bit systems to obtain sensitive information by accessing log files that contain improperly logged sensitive data.

The vulnerability stems from inadequate log sanitization practices within the SCIM Driver module, where sensitive information such as credentials, tokens, or other confidential data may be written to log files during normal operations. Local users with access to these log files can extract this sensitive information, potentially leading to credential theft, privilege escalation, or further lateral movement within the identity management infrastructure.

Critical Impact

Authenticated local users can extract sensitive information including potential credentials and tokens from SCIM Driver log files, compromising identity management security.

Affected Products

• OpenText IDM SCIM Driver versions 1.0.0.0000 through 1.0.1.0300
• OpenText IDM SCIM Driver version 1.1.0.0000
• OpenText IDM Driver and Extensions on Windows and Linux 64-bit platforms

Discovery Timeline

• 2026-03-27 - CVE-2024-11604 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2024-11604

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), a common security weakness where applications inadvertently write sensitive data to log files without proper sanitization or redaction. In the context of the OpenText IDM SCIM Driver, this represents a significant security concern given that identity management systems typically handle highly sensitive authentication credentials, tokens, and user identity information.

The SCIM (System for Cross-domain Identity Management) protocol is designed to automate user provisioning and identity management across cloud applications and services. When the SCIM Driver logs operational data without proper sanitization, it may expose authentication tokens, API keys, user credentials, or other sensitive identity-related information in plaintext within log files.

The local attack vector requires an authenticated user to have filesystem access to the log file locations on either Windows or Linux systems. While this limits remote exploitation, insider threats and compromised local accounts present a realistic attack scenario. Organizations running multi-tenant environments or shared systems are at particular risk.

Root Cause

The root cause of CVE-2024-11604 lies in insufficient input/output sanitization within the logging functionality of the SCIM Driver module. During debug, error handling, or normal operational logging, the driver writes data to log files without properly redacting sensitive fields such as:

• Authentication credentials and passwords
• OAuth tokens and API keys
• Session identifiers
• User identity attributes
• SCIM provisioning payloads containing sensitive user data

The logging implementation fails to implement adequate filtering mechanisms to prevent sensitive information from being persisted to disk in readable format.

Attack Vector

The attack requires local access to the system running the affected OpenText IDM SCIM Driver. An attacker with authenticated local user access would:

1. Identify the log file location for the SCIM Driver on the Windows or Linux system
2. Access the log files directly via filesystem read permissions
3. Parse the log contents to extract sensitive information such as credentials, tokens, or identity data
4. Utilize the extracted information for credential theft, privilege escalation, or lateral movement

The attack does not require special tools or exploit code—standard file system access and text parsing utilities are sufficient to extract the leaked sensitive information from the log files.

Detection Methods for CVE-2024-11604

Indicators of Compromise

• Unusual file access patterns to SCIM Driver log file directories
• Unauthorized users or processes reading identity management log files
• Evidence of log file copying, archiving, or exfiltration activities
• Anomalous login attempts using credentials that may have been extracted from logs

Detection Strategies

• Monitor filesystem access to SCIM Driver log directories using file integrity monitoring (FIM) solutions
• Implement audit logging for all access to identity management system directories
• Configure SentinelOne to detect suspicious file read operations targeting log file locations
• Deploy user behavior analytics to identify anomalous access patterns to sensitive log files
• Review log file permissions to identify overly permissive access configurations

Monitoring Recommendations

• Enable detailed audit logging for the directories containing SCIM Driver logs on Windows (via Security Event Log) and Linux (via auditd)
• Configure alerting for non-administrative users accessing identity management log directories
• Implement centralized log collection to detect bulk log file access or exfiltration attempts
• Use SentinelOne's behavioral AI to detect suspicious file access sequences indicative of credential harvesting

How to Mitigate CVE-2024-11604

Immediate Actions Required

• Restrict file system permissions on SCIM Driver log directories to only essential administrative accounts
• Audit current log file contents for exposed sensitive information and rotate/delete affected logs
• Review and limit which users have local access to systems running the SCIM Driver
• Rotate any credentials or tokens that may have been logged and potentially exposed
• Update to patched versions of the SCIM Driver as documented in the vendor advisories

Patch Information

OpenText has released updated versions of the IDM SCIM Driver that address this vulnerability. Organizations should update to:

• SCIM Driver version 1.0.1.0400 or later for the 1.0.x branch
• SCIM Driver version 1.1.0.0100 or later for the 1.1.x branch

Detailed patch information and upgrade instructions are available in the NetIQ SCIM Driver 1.0 Readme and NetIQ SCIM Driver 1.1 Readme.

Workarounds

• Implement strict file system ACLs to restrict log file access to only the SCIM Driver service account and authorized administrators
• Configure log rotation with secure deletion to minimize the window of exposure for sensitive data in logs
• Move log files to a protected directory with enhanced access controls
• Consider reducing logging verbosity to minimize sensitive data exposure until patches can be applied
• Implement network segmentation to limit local access to systems running identity management components

# Configuration example - Restrict SCIM Driver log directory permissions on Linux
chmod 700 /var/log/scim-driver/
chown root:root /var/log/scim-driver/
# Review and audit current log file access
ls -la /var/log/scim-driver/
# Configure auditd monitoring for log directory access
auditctl -w /var/log/scim-driver/ -p r -k scim_log_access