CVE-2024-22329: IBM WebSphere Application Server SSRF Flaw

CVE-2024-22329 Overview

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack. This vulnerability allows attackers to make the server perform requests to arbitrary internal or external destinations, potentially exposing sensitive information or enabling further attacks against internal infrastructure.

Critical Impact

Attackers can leverage SSRF to access internal network resources, potentially bypassing security controls and exposing sensitive data from systems that would otherwise be inaccessible from external networks.

Affected Products

• IBM WebSphere Application Server 8.5 (Traditional)
• IBM WebSphere Application Server 9.0 (Traditional)
• IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3

Discovery Timeline

• 2024-04-17 - CVE CVE-2024-22329 published to NVD
• 2025-03-06 - Last updated in NVD database

Technical Details for CVE-2024-22329

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in IBM WebSphere Application Server allows an attacker on an adjacent network to induce the application to make HTTP requests to an arbitrary domain of the attacker's choosing. The vulnerability requires no user interaction and can be exploited without authentication.

SSRF vulnerabilities occur when a web application fetches a remote resource without properly validating the user-supplied URL. In the context of IBM WebSphere Application Server, this could allow an attacker to probe internal services, access cloud metadata endpoints, or exfiltrate data through the trusted server.

Root Cause

The root cause of this vulnerability is improper validation of user-supplied input that is used to construct server-side HTTP requests. The application fails to adequately restrict or sanitize URLs before using them to fetch remote resources, allowing attackers to manipulate the destination of these requests.

Attack Vector

The attack vector for CVE-2024-22329 requires adjacent network access, meaning the attacker must be on the same network segment as the vulnerable WebSphere server. The attacker sends a specially crafted request containing a malicious URL that the server then processes and attempts to fetch. This could allow the attacker to:

• Access internal services and APIs not exposed to external networks
• Probe internal network infrastructure for reconnaissance
• Access cloud provider metadata services (e.g., AWS IMDSv1)
• Potentially pivot to other vulnerable internal systems

The vulnerability can be exploited by manipulating request parameters that the WebSphere server uses to construct outbound HTTP requests. The attacker-controlled URL causes the server to send requests on behalf of the attacker, effectively using the server as a proxy to access otherwise restricted resources.

Detection Methods for CVE-2024-22329

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from WebSphere Application Server to internal IP addresses or unexpected external domains
• Server-side requests targeting cloud metadata endpoints (e.g., 169.254.169.254)
• Requests containing encoded or obfuscated URLs in parameters
• Anomalous traffic patterns from application servers to internal infrastructure services

Detection Strategies

• Monitor outbound network traffic from WebSphere servers for connections to internal RFC 1918 IP ranges that are not part of normal application behavior
• Implement network segmentation and firewall rules to detect unauthorized egress traffic from application servers
• Deploy web application firewall (WAF) rules to detect SSRF attack patterns in incoming requests
• Review application logs for requests with unusual URL parameters or encoding schemes

Monitoring Recommendations

• Enable detailed access logging on IBM WebSphere Application Server to capture all incoming requests and their parameters
• Configure network monitoring tools to alert on outbound connections from WebSphere to non-whitelisted destinations
• Implement SentinelOne Singularity XDR to monitor for behavioral anomalies indicative of SSRF exploitation
• Set up alerts for any requests from WebSphere servers to cloud metadata endpoints or internal-only services

How to Mitigate CVE-2024-22329

Immediate Actions Required

• Apply the latest security patches from IBM for all affected WebSphere Application Server versions
• Implement network segmentation to limit outbound connectivity from WebSphere servers
• Deploy allowlists for valid external destinations that the application server is permitted to contact
• Review and restrict any application functionality that accepts user-controlled URLs

Patch Information

IBM has released security updates to address this vulnerability. Refer to IBM Support Advisory #7148380 for specific patch versions and download links. Organizations should upgrade to the latest patched versions of IBM WebSphere Application Server Traditional (8.5.x and 9.0.x fixes) and WebSphere Application Server Liberty (versions after 24.0.0.3).

For additional technical details, see IBM X-Force Vulnerability #279951.

Workarounds

• Implement strict egress filtering on WebSphere Application Server hosts to block outbound connections to internal networks and sensitive endpoints
• Configure web application firewalls to inspect and block requests containing suspicious URL patterns
• Disable or restrict application features that process user-supplied URLs until patches can be applied
• Use network policies to restrict WebSphere server outbound traffic to only approved external services

# Example: Restrict outbound connections from WebSphere using iptables
# Allow only necessary outbound connections, block access to internal networks
iptables -A OUTPUT -m owner --uid-owner websphere -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner websphere -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner websphere -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner websphere -d 169.254.169.254 -j DROP