CVE-2024-28767: IBM Security Directory Integrator RCE Flaw

CVE-2024-28767 Overview

CVE-2024-28767 is a command injection vulnerability [CWE-78] affecting IBM Security Directory Integrator (ISDI). The flaw impacts versions 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3. A remote authenticated attacker can execute arbitrary operating system commands on the underlying host by sending a specially crafted request. Successful exploitation compromises confidentiality, integrity, and availability of the affected system. IBM has published a security advisory and remediation guidance on the IBM Support Page.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on ISDI hosts, leading to full compromise of directory integration workflows and any credentials or data those workflows access.

Affected Products

IBM Security Directory Integrator 7.2.0 through 7.2.0.13
IBM Security Directory Integrator 10.0.0 through 10.0.3
Deployments exposing the ISDI management or configuration endpoints to authenticated users

Discovery Timeline

2024-12-20 - CVE-2024-28767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28767

Vulnerability Analysis

IBM Security Directory Integrator synchronizes identity data across heterogeneous directories, databases, and applications using AssemblyLines and connectors. CVE-2024-28767 stems from improper neutralization of special elements passed to an OS command, classified under [CWE-78]. An authenticated user with access to a vulnerable request handler can inject shell metacharacters or command separators into input that ISDI passes to an operating system shell. The injected commands run with the privileges of the ISDI service account, which typically holds broad access to directory sources, credentials, and network resources. Because ISDI acts as a data broker between authoritative identity systems, compromise of the process exposes downstream identity infrastructure.

Root Cause

The root cause is missing or insufficient sanitization of attacker-controlled input that ultimately reaches an OS command execution path. Instead of parameterizing the invocation or applying an allowlist, the affected code path concatenates user-influenced values into a command string interpreted by the shell. Any character with shell meaning, such as ;, &&, |, or backticks, alters execution flow.

Attack Vector

Exploitation requires network access to the ISDI service and valid low-privileged credentials. No user interaction is required, and attack complexity is low. An attacker sends a crafted HTTP request containing shell metacharacters in a parameter the server passes to a system command. IBM has not published proof-of-concept exploitation details, and no public exploit is currently available. See the IBM Support Page for vendor-supplied technical detail.

No verified proof-of-concept code is publicly available for this issue. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2024-28767

Indicators of Compromise

Unexpected child processes spawned by the ISDI Java process, particularly sh, bash, cmd.exe, or powershell.exe.
HTTP requests to ISDI endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks in parameter values.
Outbound network connections from ISDI hosts to previously unseen IP addresses or download utilities like curl or wget invoked by the ISDI account.
New or modified files in ISDI working directories that do not correspond to configured AssemblyLines.

Detection Strategies

Baseline the process tree of the ISDI service and alert on any deviation, especially command interpreters as descendants.
Inspect application and web server logs for parameter values containing shell control characters directed at ISDI request handlers.
Correlate authentication events with subsequent process-creation and network-egress events on ISDI hosts to identify abuse of legitimate credentials.

Monitoring Recommendations

Forward ISDI application logs, OS process telemetry, and web-tier access logs to a centralized analytics platform for retention and correlation.
Monitor ISDI service-account activity across connected directories for anomalous read or write operations that may follow host compromise.
Track configuration file changes and AssemblyLine modifications for unauthorized edits that could persist attacker access.

How to Mitigate CVE-2024-28767

Immediate Actions Required

Apply the fixes referenced in the IBM Support Page for CVE-2024-28767 without delay.
Restrict network access to ISDI management interfaces to trusted administrative networks only.
Rotate credentials used by ISDI connectors and the ISDI service account after patching, in case they were exposed.
Review authentication logs for unexpected logins by low-privileged accounts that could reach the vulnerable endpoint.

Patch Information

IBM has released remediated builds of IBM Security Directory Integrator addressing versions 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3. Consult the IBM Support Page for the exact fix pack versions, upgrade paths, and installation instructions applicable to your deployment.

Workarounds

Limit ISDI accounts to the minimum set of users required for operations, and remove unused accounts.
Place ISDI behind a reverse proxy or web application firewall with rules that block shell metacharacters in request parameters targeting ISDI URIs.
Run the ISDI service under a dedicated, least-privileged OS account with restricted filesystem and network permissions.

bash

# Example: restrict ISDI listener to a management subnet using host firewall (Linux)
# Replace 10.10.0.0/24 with your administrative network and 1099 with the ISDI port in use
iptables -A INPUT -p tcp --dport 1099 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1099 -j DROP