CVE-2024-22348: IBM DevOps Velocity Auth Bypass Flaw

CVE-2024-22348 Overview

CVE-2024-22348 affects IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25. The application implements Cross-Origin Resource Sharing (CORS) without restricting the allowed origin to trusted domains. An attacker can exploit this misconfiguration to issue cross-origin requests from a malicious site against an authenticated user's session. Successful exploitation allows the attacker to perform privileged actions and retrieve sensitive information from the affected instance. The weakness is classified under [CWE-942] Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Network-based attackers can leverage permissive CORS policies to read sensitive data and trigger privileged operations against authenticated users without requiring credentials of their own.

Affected Products

IBM DevOps Velocity 5.0.0
IBM UrbanCode Velocity 4.0.0 through 4.0.25
Web interfaces relying on the Velocity API surface

Discovery Timeline

2025-01-20 - CVE-2024-22348 published to NVD
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2024-22348

Vulnerability Analysis

The vulnerability stems from an overly permissive CORS configuration in IBM DevOps Velocity and UrbanCode Velocity. The server returns Access-Control-Allow-Origin responses that do not restrict requests to a trusted allowlist of domains. Browsers therefore honor cross-origin requests originating from attacker-controlled sites against the Velocity application. When a victim with an active Velocity session visits a malicious page, the attacker's JavaScript can read responses from authenticated API endpoints. This exposes pipeline data, configuration values, and other sensitive information handled by the platform.

The issue is exclusively a confidentiality risk in the published CVSS data, with no impact on integrity or availability. However, attackers can still chain the flaw with API endpoints that perform state-changing operations to execute privileged actions in the victim's context. The CWE-942 classification indicates the root weakness is a permissive cross-domain policy with untrusted domains.

Root Cause

The Velocity API echoes or accepts arbitrary Origin header values rather than validating each request against a configured allowlist of trusted domains. Pre-flight and simple cross-origin requests therefore succeed regardless of where they originate. The result is that any external website loaded in the victim's browser can interact with Velocity endpoints using the victim's session cookies or tokens.

Attack Vector

Exploitation requires the attacker to lure an authenticated Velocity user to a controlled web page. The page issues fetch or XMLHttpRequest calls to the target Velocity instance with credentials included. Because the server returns a permissive Access-Control-Allow-Origin response, the browser delivers the response body to the attacker's script. The attacker can then exfiltrate sensitive data or trigger privileged API calls available to the victim's role.

No proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the IBM Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-22348

Indicators of Compromise

Velocity HTTP responses containing Access-Control-Allow-Origin headers reflecting arbitrary or untrusted Origin values
Unexpected cross-origin XHR or fetch requests to Velocity API endpoints from non-IBM domains in browser or proxy logs
Authenticated API access patterns originating immediately after a user visits an external referrer
Bulk reads of sensitive Velocity resources from a single session in short time windows

Detection Strategies

Inspect HTTP response headers from Velocity instances and alert when Access-Control-Allow-Origin is set to * or mirrors untrusted request origins
Review web application firewall logs for cross-origin requests carrying session cookies to Velocity endpoints
Correlate browser referrer headers against authenticated Velocity API access to identify suspicious origin chains

Monitoring Recommendations

Forward Velocity access logs and reverse-proxy telemetry to a centralized analytics platform for cross-origin anomaly review
Monitor for spikes in OPTIONS pre-flight requests followed by data-heavy GET calls from new external referrers
Track administrative or privileged API endpoints for invocations that originate from unfamiliar referrer domains

How to Mitigate CVE-2024-22348

Immediate Actions Required

Upgrade IBM DevOps Velocity 5.0.0 and UrbanCode Velocity 4.0.x to the fixed versions listed in the IBM advisory
Restrict network exposure of the Velocity console and API to trusted networks until patching is complete
Force re-authentication of active sessions after applying the patch to invalidate any tokens harvested cross-origin

Patch Information

IBM has published remediation guidance and fixed builds in the official IBM Security Advisory. Apply the vendor-supplied update for IBM DevOps Velocity 5.0.0 and upgrade UrbanCode Velocity instances running 4.0.0 through 4.0.25 to the patched release identified by IBM.

Workarounds

Place Velocity behind a reverse proxy that enforces a strict Access-Control-Allow-Origin allowlist limited to trusted internal domains
Configure the proxy to strip or reject requests carrying untrusted Origin headers before they reach the Velocity API
Require SameSite=Strict or Lax session cookies and short session lifetimes to limit the window for cross-origin abuse
Educate Velocity users to avoid accessing unknown links while authenticated to the platform

bash

# Example reverse-proxy CORS allowlist (nginx)
map $http_origin $cors_origin {
    default "";
    "https://velocity.example.com" $http_origin;
    "https://devops.example.com"   $http_origin;
}

server {
    location / {
        add_header Access-Control-Allow-Origin $cors_origin always;
        add_header Vary Origin always;
        if ($cors_origin = "") { return 403; }
        proxy_pass http://velocity_backend;
    }
}