CVE-2024-25034: IBM Planning Analytics RCE Vulnerability

CVE-2024-25034 Overview

IBM Planning Analytics versions 2.0 and 2.1 contain an unrestricted file upload vulnerability in the File Manager T1 process. The application fails to validate the type of uploaded files, allowing attackers to upload arbitrary executables to the server. Attackers can then deliver these malicious files to victims as part of follow-on attacks against the enterprise environment.

The weakness is tracked as CWE-434: Unrestricted Upload of File with Dangerous Type. Exploitation requires user interaction but no privileges, and can be triggered over the network.

Critical Impact
A network-based attacker can upload malicious executables to IBM Planning Analytics and weaponize the trusted server to distribute payloads to internal users, compromising confidentiality, integrity, and availability.

Affected Products

IBM Planning Analytics 2.0
IBM Planning Analytics 2.1
File Manager T1 process component

Discovery Timeline

2025-01-24 - CVE-2024-25034 published to NVD
2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-25034

Vulnerability Analysis

IBM Planning Analytics is an enterprise planning, budgeting, and forecasting platform built on the TM1 engine. The File Manager T1 process is responsible for handling file operations on behalf of authenticated and, in some configurations, externally reachable users.

The File Manager T1 process does not validate the MIME type, file extension, or content signature of uploaded files. As a result, an attacker can submit an executable, script, or other dangerous file type that the upload handler accepts and stores. The classification under CWE-434 confirms the absence of dangerous-type checks on uploaded content.

Because the file resides on a trusted IBM Planning Analytics host, victims who later retrieve or are sent the file are more likely to execute it. The Exploit Prediction Scoring System (EPSS) currently places this issue at a 0.362% probability with a percentile of 27.8.

Root Cause

The root cause is missing server-side file type validation in the File Manager T1 upload routine. The handler accepts the uploaded blob without enforcing an allowlist of permitted extensions, scanning content magic bytes, or rejecting executable formats such as .exe, .dll, .bat, .js, or .hta.

Attack Vector

Exploitation is performed remotely over the network against the Planning Analytics web interface. An attacker submits a crafted upload request to the File Manager T1 process containing a malicious executable. User interaction is required to complete the attack, typically by convincing a target to download or run the file that has been staged on the trusted server.

No verified public proof-of-concept code is available for this issue. Refer to the IBM Support advisory for vendor-confirmed technical context.

Detection Methods for CVE-2024-25034

Indicators of Compromise

Unexpected executable file types (.exe, .dll, .bat, .ps1, .hta, .js) stored in IBM Planning Analytics File Manager directories.
Outbound links or emails referencing files hosted on the Planning Analytics server domain that lead to executable downloads.
Anomalous POST requests to the File Manager T1 upload endpoint from unfamiliar source IPs or user accounts.

Detection Strategies

Inspect web server and TM1 application logs for upload requests with content types or filenames that do not match expected business document formats.
Hash and scan all files staged in Planning Analytics file repositories against malware signatures and YARA rules.
Correlate upload events with subsequent download activity to identify staging-and-distribution patterns indicative of payload delivery.

Monitoring Recommendations

Enable detailed audit logging on the File Manager T1 process and forward events to a centralized SIEM for correlation.
Monitor endpoints that retrieve files from the Planning Analytics server for execution of newly downloaded binaries.
Alert on creation of files with executable extensions inside directories that should only contain spreadsheets, CSVs, or planning models.

How to Mitigate CVE-2024-25034

Immediate Actions Required

Apply the fix referenced in the IBM Support advisory for CVE-2024-25034 to all Planning Analytics 2.0 and 2.1 deployments.
Restrict access to the Planning Analytics web interface to authenticated users on trusted networks until patching is complete.
Audit existing File Manager storage locations and remove any files with executable extensions or unexpected content.

Patch Information

IBM has published remediation guidance and fix availability on the IBM Support page for this advisory. Administrators should review the bulletin to identify the appropriate interim fix or upgrade path for their installed version of Planning Analytics.

Workarounds

Place a reverse proxy or web application firewall in front of Planning Analytics and block uploads of dangerous file extensions and MIME types.
Enforce least privilege on the operating system account running the TM1 service so uploaded files cannot be executed in privileged contexts.
Train users to treat files hosted on internal application servers with the same scrutiny as external downloads and to verify file provenance before opening.

bash

# Example reverse proxy filter (nginx) blocking dangerous upload extensions
location /pmpsvc/ {
    if ($request_method = POST) {
        if ($request_uri ~* "\.(exe|dll|bat|cmd|ps1|hta|js|vbs|jar|msi)(\?|$)") {
            return 403;
        }
    }
    proxy_pass http://planning_analytics_backend;
}