CVE-2024-27275: IBM i Privilege Escalation Vulnerability

CVE-2024-27275 Overview

CVE-2024-27275 is a local privilege escalation vulnerability in IBM i versions 7.2, 7.3, 7.4, and 7.5. The flaw stems from an insufficient authority requirement in the physical file trigger configuration mechanism. A local user without administrator privilege can configure a physical file trigger that executes with the privileges of another user who is socially engineered into accessing the target file. Successful exploitation grants the attacker code execution under the higher-privileged user's context. IBM's correction requires administrator privilege to configure trigger support. The vulnerability is tracked under CWE-266 (Incorrect Privilege Assignment) and CWE-287 (Improper Authentication).

Critical Impact
A low-privileged local user can escalate to the privileges of any user coerced into accessing a booby-trapped physical file, resulting in full confidentiality, integrity, and availability compromise of the targeted account context.

Affected Products

IBM i 7.2
IBM i 7.3
IBM i 7.4
IBM i 7.5

Discovery Timeline

2024-06-15 - CVE-2024-27275 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27275

Vulnerability Analysis

IBM i supports physical file triggers, which are user-defined programs invoked automatically when database operations such as insert, update, or delete occur against a file. Trigger programs run in the context of the user who performs the triggering database operation, not the user who configured the trigger. In vulnerable releases of IBM i, configuring a trigger on a physical file did not require administrator authority. Any local user with sufficient object rights on a target file can attach a malicious trigger program to it. When a privileged user, such as a security officer or administrator, is convinced to open, read, insert, or update the affected file, the attacker's trigger program executes under that user's privileges. This constitutes a classic confused-deputy scenario compounded by a social engineering requirement, reflected in the user interaction requirement of the attack.

Root Cause

The root cause is an insufficient authority check when creating or altering triggers on physical files. IBM i failed to enforce administrator-level authority on trigger configuration, allowing standard users to weaponize files they can modify. The fix requires administrator privilege to configure trigger support, aligning trigger management with the sensitivity of the code execution it enables.

Attack Vector

The attack is local and requires user interaction. An attacker with a valid local IBM i account attaches a crafted trigger program to a physical file that a higher-privileged user is expected to access. When the victim performs a database operation on that file, the trigger program executes with the victim's authority. The attacker uses this execution to run arbitrary CL commands, create profiles, grant special authorities, or alter system objects, achieving privilege escalation. No network access is required, and attack complexity is low. See the IBM X-Force entry for additional context.

Detection Methods for CVE-2024-27275

Indicators of Compromise

Unexpected ADDPFTRG (Add Physical File Trigger) or CHGPFTRG operations initiated by non-administrative user profiles in the QAUDJRN audit journal.
Trigger programs residing in user libraries owned by standard user profiles yet attached to shared or privileged data files.
New or modified user profiles with *ALLOBJ, *SECADM, or other special authorities created shortly after a privileged user accessed a shared file.
Trigger programs that spawn QCMDEXC, QSYS/QCAPCMD, or shell escapes to QP2SHELL under the security officer's user profile.

Detection Strategies

Audit the QAUDJRN journal for T-OM (object management) and T-PG (program adopt) entries associated with trigger creation or invocation by non-administrative profiles.
Enumerate all physical files carrying triggers using DSPFD TYPE(*TRG) and cross-reference the trigger program owner against the file owner to identify authority mismatches.
Baseline expected trigger programs on production files and alert on additions or modifications outside of change control windows.
Correlate trigger execution events with the effective user profile at runtime to detect execution under privileged identities from user-owned code.

Monitoring Recommendations

Forward IBM i security audit journal entries to a centralized SIEM for continuous review of trigger management activity.
Alert on any invocation of ADDPFTRG, RMVPFTRG, or CHGPFTRG outside of an approved administrator list.
Monitor for creation of new user profiles or grants of special authorities immediately following triggered file access by administrators.

How to Mitigate CVE-2024-27275

Immediate Actions Required

Apply the IBM PTFs referenced in the IBM Support advisory for each affected release of IBM i 7.2, 7.3, 7.4, and 7.5.
Enumerate existing triggers on production physical files and remove any trigger programs owned by non-administrative profiles that were not sanctioned.
Restrict *CHANGE and *OBJMGT authorities on sensitive physical files to administrator profiles only.
Educate administrators to avoid opening or updating files residing in user-owned libraries unless the trigger inventory has been verified.

Patch Information

IBM has released fixes that enforce administrator authority for configuring physical file triggers. The remediation is delivered via product-specific PTFs listed on the IBM Support page for node 7157637. Administrators should identify the appropriate PTF group for their IBM i release level and apply it through standard PTF management procedures.

Workarounds

Revoke authority to add or change triggers (ADDPFTRG, CHGPFTRG) from *PUBLIC and from user profiles that do not require it.
Move sensitive shared files into libraries where standard users lack *OBJMGT and *OBJALTER authority, preventing trigger attachment.
Require administrators to use dedicated adopting programs rather than directly opening user-controlled files.
Enable and review QAUDLVL object auditing on high-value files to surface unauthorized trigger modifications.

bash

# Example: audit and remove unauthorized triggers on IBM i
# Display triggers currently attached to a physical file
DSPFD FILE(PRODLIB/CUSTMAST) TYPE(*TRG)

# Revoke public authority to change or add triggers
RVKOBJAUT OBJ(PRODLIB/CUSTMAST) OBJTYPE(*FILE) USER(*PUBLIC) AUT(*OBJMGT *OBJALTER)

# Remove an unauthorized trigger program from a file
RMVPFTRG FILE(PRODLIB/CUSTMAST) TRGTIME(*ALL) TRGEVENT(*ALL)