CVE-2024-35144: IBM Maximo Application Suite Information Disclosure

CVE-2024-35144 Overview

IBM Maximo Application Suite contains an information disclosure vulnerability in its Monitor Component. The affected versions store source code on the web server, where unauthenticated remote actors can retrieve it. Attackers can use the exposed source to identify additional weaknesses, locate hardcoded values, or map internal application logic for follow-on attacks. The issue is tracked under CWE-540: Inclusion of Sensitive Information in Source Code and affects Maximo Application Suite versions 8.10, 8.11, and 9.0.

Critical Impact
Unauthenticated network attackers can retrieve application source code from the Monitor Component, enabling reconnaissance that facilitates subsequent exploitation of the environment.

Affected Products

IBM Maximo Application Suite 8.10
IBM Maximo Application Suite 8.11
IBM Maximo Application Suite 9.0

Discovery Timeline

2025-01-25 - CVE-2024-35144 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35144

Vulnerability Analysis

The Monitor Component of IBM Maximo Application Suite ships or deploys source code files inside a web-accessible directory. Remote clients can request these resources directly over the network without authentication or user interaction. Because only confidentiality is affected, the flaw does not modify data or disrupt availability, but it exposes application internals that should remain server-side.

Source code retrieved through this path may reveal implementation details, internal API routes, database query construction, and business logic. Adversaries can analyze the code offline to develop targeted exploits against the deployment. This class of exposure typically precedes more damaging attacks such as injection, authentication bypass, or credential reuse when secrets are embedded in the code.

Root Cause

The vulnerability maps to CWE-540: Inclusion of Sensitive Information in Source Code. Source files that should be compiled, executed, or restricted to backend directories are instead resident within the web server document root. The application does not enforce access controls that would prevent HTTP clients from reading those files.

Attack Vector

Exploitation occurs over the network against the Maximo Monitor web interface. An attacker issues standard HTTP or HTTPS requests to file paths that host the exposed source. No credentials, elevated privileges, or victim interaction are required. Successful retrieval yields readable source content that supports reconnaissance and secondary attack planning.

No public proof-of-concept, exploit database entry, or CISA KEV listing exists for this CVE at the time of publication. See the IBM Support Page for vendor guidance.

Detection Methods for CVE-2024-35144

Indicators of Compromise

HTTP GET requests to Monitor Component paths that return file extensions associated with source code such as .py, .js, .jsp, .java, or configuration templates.
Web server access logs showing external clients enumerating static paths with sequential or dictionary-style requests against Maximo hosts.
Responses returning text/plain or application/octet-stream content types for URLs that should render as application views.

Detection Strategies

Review web server and reverse proxy logs for successful 200 responses to URIs that expose source files under Monitor Component directories.
Baseline normal Maximo traffic and alert on unauthenticated retrieval of file types that are not part of the expected client workload.
Correlate source-file downloads from a single source IP with subsequent authentication attempts or parameter tampering against Maximo endpoints.

Monitoring Recommendations

Enable verbose access logging on the web server fronting Maximo Application Suite and forward logs to a centralized analytics platform.
Monitor egress bandwidth from Maximo hosts for unusual spikes tied to specific client IPs.
Track vulnerability scanner signatures and web crawlers touching Monitor Component paths outside sanctioned assessment windows.

How to Mitigate CVE-2024-35144

Immediate Actions Required

Apply the fixes documented on the IBM Support Page for Maximo Application Suite versions 8.10, 8.11, and 9.0.
Inventory all Maximo Monitor Component deployments and confirm patch status before returning them to production traffic.
Rotate any credentials, API keys, or tokens that may have been embedded in the exposed source files.

Patch Information

IBM has published remediation guidance for the Monitor Component under advisory reference node/7174953. Administrators should consult the IBM Support Page for the specific fix pack, interim fix, or upgrade path applicable to their installed release of Maximo Application Suite.

Workarounds

Restrict network access to the Maximo Monitor Component using firewall rules, VPN gating, or an authenticating reverse proxy until patches are applied.
Configure the web server to deny direct requests for source file extensions and to return 403 responses for non-application content types.
Remove or relocate any source, backup, or template files that reside inside the web server document root but are not required for runtime.

bash

# Example reverse proxy rule to block direct source retrieval
location ~* \.(py|java|jsp|jspx|bak|inc|tpl|config)$ {
    deny all;
    return 403;
}