CVE-2024-28770: IBM Security Directory Integrator Cookie Exposure

CVE-2024-28770 Overview

CVE-2024-28770 affects IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0. The products fail to set the Secure attribute on authorization tokens and session cookies. Browsers therefore transmit these cookies over unencrypted HTTP connections whenever a user follows an http:// link to the application host. An attacker who observes network traffic can capture the cookie values and reuse them to hijack the authenticated session. The weakness is tracked under [CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute].

Critical Impact
Attackers positioned on the network path can capture session cookies transmitted over cleartext HTTP and hijack authenticated Directory Integrator sessions.

Affected Products

IBM Security Directory Integrator 7.2.0
IBM Security Verify Directory Integrator 10.0.0
Deployments exposing the administrative or runtime interfaces over mixed HTTP/HTTPS access

Discovery Timeline

2025-01-27 - CVE-2024-28770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28770

Vulnerability Analysis

The flaw is a cookie hardening defect. When IBM Security Directory Integrator and IBM Security Verify Directory Integrator issue authorization tokens or session cookies, the Set-Cookie header omits the Secure attribute. Without this attribute, browsers include the cookie on any request to the same host regardless of scheme.

An attacker triggers exposure by luring an authenticated user to open an http:// URL pointing to the Directory Integrator host. This can be delivered through email, chat, an embedded image, or a compromised third-party site. The browser attaches the session cookie to the plaintext request. Any adversary sniffing the network path, whether on shared Wi-Fi, a compromised router, or via ARP or BGP redirection, reads the cookie in cleartext.

Because Directory Integrator manages identity data flows between authoritative sources, a captured session grants access to sensitive integration configurations and data pipelines.

Root Cause

The root cause is missing security metadata on issued cookies. The application server does not append Secure (and likely does not enforce HttpOnly and SameSite in a defense-in-depth posture). The cookie policy assumes the transport channel will always be HTTPS, but browsers do not enforce that assumption without the attribute.

Attack Vector

Exploitation requires network access to the victim's traffic path and user interaction to load an http:// resource on the Directory Integrator hostname. No authentication is required by the attacker. The result is disclosure of a valid session identifier, enabling session hijacking against the confidentiality of the application.

No verified public exploit code is available for this issue. The vulnerability mechanism is described in the IBM Support advisory.

Detection Methods for CVE-2024-28770

Indicators of Compromise

HTTP (port 80) requests to the Directory Integrator hostname that carry a Cookie header containing session or authorization tokens.
Authenticated sessions originating from IP addresses or user agents that do not match the legitimate user's baseline.
Concurrent active sessions for the same account from geographically distant sources.

Detection Strategies

Inspect Set-Cookie responses from Directory Integrator endpoints and flag any that omit the Secure attribute.
Correlate web proxy and firewall logs for cleartext HTTP requests to hosts running IBM Security Directory Integrator or IBM Security Verify Directory Integrator.
Alert on session reuse across disparate source IPs within a short time window.

Monitoring Recommendations

Enable HTTP transaction logging on load balancers and reverse proxies fronting the Directory Integrator services.
Forward web server and identity audit logs to a centralized analytics platform for cookie-header and session-reuse queries.
Monitor DNS and referrer telemetry for http:// links that resolve to Directory Integrator hostnames.

How to Mitigate CVE-2024-28770

Immediate Actions Required

Apply the fixed version referenced in the IBM Support advisory.
Force HTTPS by enabling HTTP Strict Transport Security (HSTS) on the hostnames serving Directory Integrator.
Invalidate all existing sessions after patching so any previously leaked cookies cannot be replayed.
Restrict Directory Integrator administrative interfaces to trusted network segments.

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support Page 7161444. Administrators should upgrade IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 to the fix level listed in that bulletin and validate that cookies issued after the upgrade include the Secure attribute.

Workarounds

Terminate all HTTP listeners and redirect port 80 traffic to HTTPS at the reverse proxy or load balancer.
Configure the front-end proxy to rewrite Set-Cookie headers and inject the Secure and HttpOnly attributes.
Deploy HSTS with includeSubDomains and preload the hostname to prevent browsers from ever issuing cleartext requests.

bash

# Example NGINX reverse proxy hardening for Directory Integrator
server {
    listen 80;
    server_name idi.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name idi.example.com;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    proxy_cookie_flags ~ secure httponly samesite=strict;

    location / {
        proxy_pass https://backend-idi:9443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}