CVE-2024-39744 Overview
IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, and 6.3 contain a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352]. An attacker can craft malicious requests that execute unauthorized actions when transmitted from an authenticated user's browser session. The web service trusts the originating user, allowing the forged request to succeed without additional verification.
The flaw affects deployments across IBM AIX, Linux, and Microsoft Windows platforms. IBM assigned this vulnerability a medium severity rating, and no public proof-of-concept exploit is currently available.
Critical Impact
An authenticated user visiting an attacker-controlled page can be coerced into performing unauthorized state-changing actions in Sterling Connect:Direct Web Services, potentially altering managed file transfer configurations.
Affected Products
- IBM Sterling Connect:Direct Web Services 6.0, 6.1.0, 6.2.0, 6.3.0
- IBM AIX, Linux, and Microsoft Windows host platforms
- Managed file transfer environments relying on the affected web console
Discovery Timeline
- 2024-08-22 - CVE-2024-39744 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-39744
Vulnerability Analysis
Sterling Connect:Direct Web Services provides a browser-based management interface for the Connect:Direct managed file transfer platform. The affected versions fail to enforce anti-CSRF protections on state-changing HTTP requests. This allows a remote attacker to craft a request that the victim's browser will submit automatically when the user visits a malicious page.
Because the attack requires user interaction, exploitation depends on social engineering. However, administrators of file transfer infrastructure are high-value targets, and successful exploitation can modify transfer configurations trusted across enterprise data flows.
Root Cause
The vulnerability stems from missing or insufficient CSRF token validation on sensitive endpoints in the Web Services component. Requests originating cross-origin are processed as if they originated from a legitimate user-initiated action, because the server relies solely on session cookies for authorization.
Attack Vector
Exploitation requires the attacker to lure an authenticated Sterling Connect:Direct Web Services user to a page under attacker control. That page issues a forged HTTP request to the target Web Services host. The browser automatically attaches the victim's session cookies, and the server executes the requested action.
No verified proof-of-concept code has been published. See the IBM Support Document #7166196 for vendor-provided technical details.
Detection Methods for CVE-2024-39744
Indicators of Compromise
- Unexpected configuration changes or new file transfer jobs created in Connect:Direct Web Services audit logs.
- HTTP requests to Web Services endpoints with Referer or Origin headers pointing to untrusted external domains.
- User session activity performing administrative actions immediately after loading external web content.
Detection Strategies
- Inspect web server access logs for POST or PUT requests to Connect:Direct Web Services endpoints originating from unexpected referrers.
- Correlate browser proxy telemetry with Connect:Direct administrative activity to identify cross-origin request patterns.
- Alert on administrative changes performed outside documented change windows or by users not typically performing configuration tasks.
Monitoring Recommendations
- Enable and centralize Connect:Direct Web Services audit logs into a SIEM or data lake for correlation.
- Monitor authentication sessions for actions taken shortly after external navigation events.
- Track configuration baseline drift on Connect:Direct nodes to detect unauthorized modifications early.
How to Mitigate CVE-2024-39744
Immediate Actions Required
- Apply the IBM-provided patches listed in the vendor advisory to all affected Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 deployments.
- Restrict access to the Web Services management interface to trusted administrative networks only.
- Instruct administrators to log out of the Web Services console when not actively performing management tasks.
Patch Information
IBM has published fixed versions and remediation guidance in IBM Support Document #7166196 and cross-referenced the issue in IBM X-Force Vulnerability #297236. Administrators should review the vendor bulletin to identify the correct fix pack for their installed version.
Workarounds
- Isolate the Web Services console behind a VPN or jump host to prevent direct browser access from general workstations.
- Enforce browser policies that block third-party cookies for the Connect:Direct Web Services origin, reducing CSRF viability.
- Require administrators to use a dedicated browser profile or privileged access workstation for Connect:Direct management.
# Example: restrict Connect:Direct Web Services access at the network layer
# Replace <mgmt_subnet> and <cd_ws_host> with environment-specific values
iptables -A INPUT -p tcp --dport 8443 -s <mgmt_subnet> -d <cd_ws_host> -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -d <cd_ws_host> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
