CVE-2024-23733: webMethods Information Disclosure Flaw

CVE-2024-23733 Overview

CVE-2024-23733 affects the Software AG webMethods Integration Server version 10.15.0 prior to Core_Fix7. The vulnerability resides in the /WmAdmin/,/invoke/vm.server/login login page. Remote attackers can reach the administration panel and disclose hostname and version information by submitting an arbitrary username with a blank password to the /WmAdmin/#/login/ URI. The flaw is categorized under [CWE-522] Insufficiently Protected Credentials and impacts confidentiality without requiring authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can reach the administration panel and harvest hostname and version metadata, enabling reconnaissance for follow-on attacks against the Integration Server.

Affected Products

Software AG webMethods Integration Server 10.15.0
Versions prior to Core_Fix7
webMethods Integration Server administration component (/WmAdmin/)

Discovery Timeline

2025-01-29 - CVE-2024-23733 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-23733

Vulnerability Analysis

The vulnerability exists in the authentication handling of the webMethods Integration Server administration interface. The /WmAdmin/,/invoke/vm.server/login endpoint accepts login requests without enforcing strict credential validation. When an attacker submits an arbitrary username with a blank password to the /WmAdmin/#/login/ URI, the server response leaks information about the underlying infrastructure.

The disclosed data includes the server hostname and software version. This information supports targeted exploitation by mapping the target to known vulnerabilities in specific Integration Server builds. The flaw maps to [CWE-522] Insufficiently Protected Credentials because the login flow does not adequately protect access to administrative metadata.

The attack vector is network-based and requires no privileges or user interaction. EPSS data places this issue at a 2.235% probability of exploitation with an 80.4 percentile rank, indicating elevated attacker interest relative to the broader CVE corpus. A proof-of-concept exists on a public exploit repository.

Root Cause

The root cause is improper input validation on the login endpoint. The server processes login requests with empty password fields and returns responses that expose server identification details. The administration panel itself becomes reachable through the URI pattern without proper access controls protecting the reconnaissance surface.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /WmAdmin/#/login/ containing an arbitrary username string and a blank password value. The Integration Server responds with administrative panel content disclosing hostname and version banners. No session, token, or prior reconnaissance is required. The attacker then uses the leaked version string to select exploits matching the target build.

A public proof-of-concept is available at the GitHub PoC Repository.

Detection Methods for CVE-2024-23733

Indicators of Compromise

HTTP requests to /WmAdmin/,/invoke/vm.server/login or /WmAdmin/#/login/ originating from untrusted networks.
Login attempts to the Integration Server administration interface containing arbitrary usernames paired with empty password parameters.
Repeated probing of the /WmAdmin/ URI namespace from a single source IP within short time windows.
Server responses returning hostname and version banners to unauthenticated clients.

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting /WmAdmin/ paths with empty password form fields.
Correlate access logs with response bodies containing version strings to identify successful information disclosure.
Deploy WAF rules that flag administrative URI access from outside management network segments.

Monitoring Recommendations

Forward Integration Server access logs to a centralized SIEM for retention and correlation.
Alert on any external source attempting authentication against /WmAdmin/ endpoints.
Track baseline request volumes to administrative paths and alert on anomalous spikes.

How to Mitigate CVE-2024-23733

Immediate Actions Required

Apply Core_Fix7 or later to Software AG webMethods Integration Server 10.15.0 installations.
Restrict network access to the /WmAdmin/ administrative interface to trusted management subnets only.
Audit existing access logs for prior reconnaissance against the affected URIs.
Rotate administrative credentials if logs show suspicious access patterns.

Patch Information

Software AG addressed this vulnerability in Core_Fix7 for webMethods Integration Server 10.15.0. Administrators running 10.15.0 below this fix level should upgrade immediately. Consult Software AG support channels for the official patch package and release notes specific to the deployed Integration Server version.

Workarounds

Place the Integration Server administration interface behind a VPN or jump host accessible only to authorized administrators.
Configure a reverse proxy or WAF to block external requests to /WmAdmin/ URIs.
Enforce IP allowlisting at the network firewall for ports exposing the administration panel.
Disable banner disclosure where configuration options permit suppressing version information in HTTP responses.

bash

# Example nginx reverse proxy rule to restrict /WmAdmin/ access
location /WmAdmin/ {
    allow 10.0.0.0/8;        # internal management network
    deny all;
    proxy_pass http://webmethods-backend;
}