CVE-2024-28787: IBM Application Gateway Info Disclosure Flaw

CVE-2024-28787 Overview

CVE-2024-28787 is a critical vulnerability affecting IBM Security Verify Access and IBM Application Gateway that enables remote attackers to extract highly sensitive private information or trigger a denial of service condition. The vulnerability can be exploited through specially crafted HTTP requests, requiring no authentication or user interaction, making it particularly dangerous for organizations relying on these identity and access management solutions.

Critical Impact
This vulnerability allows unauthenticated remote attackers to compromise sensitive authentication data and disrupt critical identity management services through malicious HTTP requests.

Affected Products

IBM Security Verify Access versions 10.0.0 through 10.0.7
IBM Application Gateway versions 20.01 through 24.03
Systems using these products for identity and access management

Discovery Timeline

2024-04-04 - CVE-2024-28787 published to NVD
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2024-28787

Vulnerability Analysis

This vulnerability is classified under CWE-650 (Trusting HTTP Permission Methods on the Server Side), indicating that the affected IBM products improperly trust HTTP request characteristics when making security decisions. The flaw exists in how IBM Security Verify Access and IBM Application Gateway process incoming HTTP requests, allowing attackers to craft malicious requests that bypass normal security controls.

The attack can be executed remotely over the network without requiring any authentication credentials or user interaction. The scope of impact extends beyond the vulnerable component itself, potentially affecting other systems that depend on the compromised identity infrastructure. While the vulnerability allows high-impact information disclosure and denial of service, it does not provide direct integrity compromise (write access to data).

Organizations using these products for Single Sign-On (SSO), multi-factor authentication, or API gateway protection face significant risk, as compromise could expose authentication tokens, session data, and other sensitive identity information.

Root Cause

The root cause stems from improper trust of HTTP permission methods on the server side (CWE-650). The affected IBM products fail to properly validate and sanitize certain HTTP request attributes, allowing attackers to manipulate request characteristics in ways that expose sensitive internal data or exhaust system resources. This design flaw allows malformed HTTP requests to reach processing logic that should otherwise be protected.

Attack Vector

The attack is network-based, requiring the attacker to have network access to the vulnerable IBM Security Verify Access or Application Gateway instance. The attacker sends specially crafted HTTP requests designed to exploit the improper trust of HTTP methods. These requests can either extract sensitive private information from the system's memory or processing context, or cause the service to become unresponsive through resource exhaustion or crash conditions.

The attack requires no prior authentication, no user interaction, and has low complexity—meaning attackers with basic skills can potentially exploit this vulnerability once they identify a target system.

Detection Methods for CVE-2024-28787

Indicators of Compromise

Unusual HTTP request patterns targeting IBM Security Verify Access or Application Gateway endpoints
Unexpected service crashes or restarts of identity management components
Anomalous network traffic volumes to authentication services
Evidence of sensitive data exfiltration in network logs

Detection Strategies

Monitor HTTP access logs for malformed or unusual request structures targeting identity services
Implement intrusion detection rules to identify exploit attempts against IBM Verify Access
Deploy web application firewalls (WAF) with rules to detect anomalous HTTP method usage
Enable verbose logging on IBM Security Verify Access to capture suspicious request details

Monitoring Recommendations

Configure alerts for service availability degradation on IBM identity management systems
Monitor for unusual response times or error rates from authentication endpoints
Track failed authentication attempts that may indicate reconnaissance activity
Review network flow data for unexpected outbound connections from identity infrastructure

How to Mitigate CVE-2024-28787

Immediate Actions Required

Review the IBM Support Documentation for specific patch information
Identify all IBM Security Verify Access instances running versions 10.0.0 through 10.0.7
Identify all IBM Application Gateway instances running versions 20.01 through 24.03
Apply network segmentation to limit exposure of vulnerable identity services
Implement enhanced monitoring on all affected systems until patches are applied

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Documentation for detailed patch instructions and download links. Additionally, the IBM X-Force Vulnerability Database entry (ID: 286584) provides supplementary technical details and remediation guidance.

Upgrade IBM Security Verify Access to a version newer than 10.0.7 and IBM Application Gateway to a version newer than 24.03 to fully remediate this vulnerability.

Workarounds

Place affected systems behind a reverse proxy or WAF with strict HTTP validation rules
Implement IP-based access controls to restrict which systems can reach identity services
Enable rate limiting on HTTP endpoints to reduce denial of service impact
Consider temporarily isolating vulnerable systems if patching cannot be performed immediately
Monitor for and block suspicious HTTP request patterns at the network perimeter

bash

# Example: Network isolation using iptables (adjust IPs as needed)
# Restrict access to IBM Verify Access to trusted management networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP