CVE-2024-25015: IBM MQ Internet Pass-Thru DoS Vulnerability

CVE-2024-25015 Overview

CVE-2024-25015 is a denial-of-service vulnerability affecting IBM MQ Internet Pass-Thru (MQIPT) in versions 9.2 LTS, 9.3 LTS, and 9.3 CD. A remote, unauthenticated attacker can send specially crafted HTTP requests that consume all available resources on the affected service. The flaw is categorized under [CWE-406] Insufficient Control of Network Message Volume (Network Amplification). IBM tracks the issue internally as X-Force ID 281278. Successful exploitation disrupts message routing between MQ queue managers and clients across firewalls, breaking middleware-dependent business workflows.

Critical Impact
Unauthenticated remote attackers can exhaust resources on IBM MQ Internet Pass-Thru, halting message traffic for any application that depends on MQ for transactional messaging.

Affected Products

IBM MQ 9.2 LTS Internet Pass-Thru
IBM MQ 9.3 LTS Internet Pass-Thru
IBM MQ 9.3 CD Internet Pass-Thru

Discovery Timeline

2024-05-01 - CVE-2024-25015 published to NVD
2025-08-21 - Last updated in NVD database

Technical Details for CVE-2024-25015

Vulnerability Analysis

IBM MQ Internet Pass-Thru (MQIPT) is a proxy that tunnels MQ traffic across HTTP and TLS boundaries, typically used to route MQ messages through firewalls and DMZ segments. The vulnerable component processes inbound HTTP requests without sufficient rate or resource controls. An attacker can submit a stream of HTTP requests that the listener accepts and queues for handling, monopolizing threads, sockets, and memory allocated to the MQIPT service.

Because MQIPT often sits at the edge of enterprise networks and accepts traffic from untrusted clients, the attack surface is directly reachable from the internet in many deployments. The result is a sustained denial of service against MQ message routing, with no impact to confidentiality or integrity.

Root Cause

The root cause is improper control of network message volume in the MQIPT HTTP listener, mapped to [CWE-406]. The component does not adequately bound the resources consumed per connection or per source, allowing a single remote actor to drive the service into resource exhaustion.

Attack Vector

Exploitation requires only network access to the MQIPT HTTP listener. No authentication and no user interaction are required. An attacker sends a high volume of HTTP requests, or crafted requests that allocate disproportionate server resources, until the proxy stops servicing legitimate MQ traffic. Refer to the IBM Support Document #7149583 and IBM X-Force Vulnerability #281278 for vendor technical details. No public proof-of-concept exploit is available, and the issue is not listed in the CISA KEV catalog.

Detection Methods for CVE-2024-25015

Indicators of Compromise

Sudden spikes in inbound HTTP connections to MQIPT listener ports from a small set of source addresses.
MQIPT log entries showing connection backlogs, thread pool saturation, or socket allocation failures.
MQ client timeouts and queue manager channel disconnects coinciding with MQIPT unresponsiveness.

Detection Strategies

Baseline normal MQIPT request rates and alert on deviations exceeding established thresholds per source IP.
Monitor process-level metrics for the MQIPT JVM, including thread count, heap usage, and open file descriptors.
Correlate firewall and reverse-proxy telemetry with MQIPT availability events to identify request floods targeting the proxy.

Monitoring Recommendations

Forward MQIPT and host-level logs to a centralized SIEM for retention and alerting on resource exhaustion patterns.
Track HTTP 5xx response rates and connection reset counts on upstream load balancers fronting MQIPT.
Alert on MQ channel status transitions to INACTIVE or RETRYING that align with proxy availability degradation.

How to Mitigate CVE-2024-25015

Immediate Actions Required

Apply the IBM-provided fix for MQIPT in IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD as documented in the vendor advisory.
Restrict network exposure of the MQIPT listener to known client networks using firewall ACLs.
Place a hardened reverse proxy or WAF in front of MQIPT to enforce connection and request-rate limits.

Patch Information

IBM has published remediation guidance and fix packs in IBM Support Document #7149583. Administrators should upgrade MQIPT to the fixed level identified for their MQ release stream. Additional vulnerability metadata is available at IBM X-Force Vulnerability #281278.

Workarounds

Limit inbound source addresses to MQIPT through host firewalls such as iptables or platform equivalents on AIX, Linux on IBM Z, Linux, and Windows.
Configure connection and concurrency caps on any upstream load balancer to throttle abusive clients.
Disable internet-facing MQIPT instances that are not strictly required until patching is complete.

bash

# Example: rate-limit inbound HTTP to MQIPT listener on Linux
iptables -A INPUT -p tcp --dport 1414 -m conntrack --ctstate NEW \
  -m limit --limit 30/min --limit-burst 60 -j ACCEPT
iptables -A INPUT -p tcp --dport 1414 -j DROP