CVE-2024-28765: IBM Security Directory Integrator Disclosure

CVE-2024-28765 Overview

CVE-2024-28765 is an information disclosure vulnerability affecting IBM Security Directory Integrator (SDI). The flaw allows a remote, unauthenticated attacker to obtain sensitive information through detailed technical error messages returned in the browser. Attackers can use the disclosed details to plan additional attacks against the affected system.

The issue is categorized under [CWE-209]: Generation of Error Message Containing Sensitive Information. The vulnerability affects IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2.

Critical Impact

Remote attackers can harvest application internals, stack traces, or configuration data from verbose error pages without authentication or user interaction.

Affected Products

• IBM Security Directory Integrator 7.2.0.0 through 7.2.0.14
• IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2

Discovery Timeline

• 2026-05-27 - CVE-2024-28765 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2024-28765

Vulnerability Analysis

IBM Security Directory Integrator returns verbose technical error messages to the browser when specific request conditions trigger an exception. These messages can include internal class names, file paths, stack traces, database identifiers, or component version data. Attackers reading the response gain reconnaissance value that accelerates follow-on exploitation.

The weakness is an information exposure issue rather than a memory or code execution flaw. No authentication is required and the attack runs over the network, which makes the vulnerability practical for opportunistic scanning. Confidentiality is impacted while integrity and availability are not.

Root Cause

The root cause is improper handling of application exceptions in the SDI web interface. Instead of returning a generic error page, the application propagates detailed diagnostic output to the client. This violates the principle of least information exposure described in [CWE-209].

Attack Vector

An attacker sends crafted HTTP requests that the SDI server cannot process cleanly. The server responds with a detailed error page containing technical artifacts. The attacker parses this output to map the deployment, identify libraries, and locate additional attack surface. No code is published for this issue; refer to the IBM Support Page for vendor details.

Detection Methods for CVE-2024-28765

Indicators of Compromise

• Repeated HTTP 4xx or 5xx responses from SDI endpoints that contain stack traces, class names, or file system paths.
• Outbound responses from SDI servers larger than baseline error pages, indicating verbose diagnostic content.
• Reconnaissance-style request patterns probing nonexistent paths, malformed parameters, or unsupported methods against SDI listeners.

Detection Strategies

• Inspect SDI web server access and error logs for high volumes of exception-producing requests from the same source address.
• Use a web application firewall or proxy to flag responses containing patterns like java.lang., at com.ibm., or Caused by:.
• Correlate authentication-less requests against SDI administrative URIs with subsequent targeted activity on the same host.

Monitoring Recommendations

• Forward SDI application logs to a centralized log platform and alert on error responses returned to external clients.
• Track changes in error response body size over time as a behavioral indicator of probing.
• Monitor for known scanner user agents and uncommon HTTP methods against SDI interfaces.

How to Mitigate CVE-2024-28765

Immediate Actions Required

• Apply the fix described on the IBM Support Page for the affected SDI versions.
• Restrict network access to SDI management interfaces so they are reachable only from trusted administrative networks.
• Review historical SDI logs for evidence of prior reconnaissance against error-producing endpoints.

Patch Information

IBM has published guidance for IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2. Consult the vendor advisory for the specific fix pack or interim fix that addresses CVE-2024-28765 in your installed version.

Workarounds

• Configure SDI to return generic error pages rather than detailed exception output until patches are deployed.
• Place a reverse proxy or WAF in front of SDI that strips stack traces and Java class references from response bodies.
• Disable verbose debug or trace logging in production deployments to reduce the data available in error responses.

# Configuration example: WAF response body filter (illustrative)
# Drop responses from SDI endpoints that contain stack trace markers
SecRule RESPONSE_BODY "@rx (java\.lang\.|at com\.ibm\.|Caused by:)" \
    "id:1002841,phase:4,deny,status:500,msg:'SDI verbose error suppressed (CVE-2024-28765)'"