CVE-2024-28771: IBM Security Directory Integrator Cookie Flaw

CVE-2024-28771 Overview

CVE-2024-28771 affects IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0. The products fail to set the Secure attribute on authorization tokens and session cookies. Without this attribute, browsers transmit cookies over unencrypted HTTP connections. An attacker who tricks a user into following an http:// link, or plants such a link on a visited site, can capture the cookie through network traffic interception. The flaw is classified under [CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute].

Critical Impact
Attackers can hijack authenticated sessions by capturing session cookies transmitted over unencrypted HTTP channels, leading to account takeover.

Affected Products

IBM Security Directory Integrator 7.2.0
IBM Security Verify Directory Integrator 10.0.0

Discovery Timeline

2025-01-27 - CVE-2024-28771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28771

Vulnerability Analysis

The vulnerability stems from the web application components in IBM Security Directory Integrator issuing session cookies and authorization tokens without the Secure flag. The Secure attribute instructs the browser to send the cookie only over HTTPS connections. When this attribute is absent, the browser attaches the cookie to any outbound request matching the cookie scope, including plain HTTP requests.

This behavior creates a window for session cookie disclosure. An attacker positioned on the network path can observe HTTP traffic and extract the cookie value. The captured cookie can then be replayed to impersonate the authenticated user. The vulnerability requires user interaction, which lowers its severity but remains exploitable in shared networks, public Wi-Fi, and compromised intermediate devices.

Root Cause

The underlying cause is a missing security directive in the Set-Cookie response header. Developers did not append the Secure attribute when the server issues authentication cookies. The product relies solely on transport layer protection rather than enforcing it through the cookie policy itself.

Attack Vector

Exploitation requires a victim to click an http:// link pointing to a host that shares the cookie scope. The attacker can deliver this link through phishing emails, chat messages, or cross-site content on compromised pages. When the browser issues the HTTP request, it attaches the session cookie to the unencrypted traffic. A network-level adversary performing passive sniffing or active man-in-the-middle (MITM) interception captures the cookie value and reuses it against the target application.

No verified proof-of-concept code is publicly available. See the IBM Support Document for vendor technical details.

Detection Methods for CVE-2024-28771

Indicators of Compromise

HTTP requests to IBM Security Directory Integrator hostnames containing valid session cookie values in plaintext.
Session cookie reuse from unexpected source IP addresses or geographies within a short time window.
Set-Cookie response headers from affected IBM products that omit the Secure attribute.

Detection Strategies

Inspect proxy and web gateway logs for authentication cookies transmitted over port 80 to Directory Integrator endpoints.
Correlate authenticated session IDs across multiple source addresses to identify potential cookie replay.
Audit HTTP response headers from Directory Integrator administrative interfaces for missing cookie security flags.

Monitoring Recommendations

Enable TLS inspection on egress traffic to detect any clear-text requests to the Directory Integrator management console.
Monitor Active Directory and application login telemetry for sessions whose user-agent or network context changes mid-session.
Alert on administrative actions originating from source addresses not previously associated with the account.

How to Mitigate CVE-2024-28771

Immediate Actions Required

Apply the fix referenced in the IBM Support Document for Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0.
Terminate active sessions and force reauthentication after remediation to invalidate potentially captured cookies.
Restrict Directory Integrator administrative interfaces to HTTPS-only listeners and disable HTTP bindings.

Patch Information

IBM has published remediation guidance in support advisory node/7161444. Administrators should consult the advisory for the specific interim fix or upgrade path applicable to their product version and deployment model.

Workarounds

Enforce HTTP Strict Transport Security (HSTS) at a reverse proxy fronting the Directory Integrator to prevent browsers from issuing HTTP requests.
Deploy network segmentation so that management interfaces are reachable only from trusted administrative subnets.
Configure the fronting proxy or load balancer to rewrite Set-Cookie headers and append the Secure and HttpOnly attributes.

bash

# Example nginx snippet to append Secure flag to upstream cookies
proxy_cookie_flags ~ secure httponly samesite=strict;

# Enforce HSTS on the administrative hostname
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;