CVE-2024-39747: IBM Sterling Connect Direct Auth Bypass

CVE-2024-39747 Overview

IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, and 6.3 contain a critical vulnerability where the application uses default credentials for potentially critical functionality. This hardcoded credentials vulnerability allows unauthenticated attackers to gain unauthorized access to the system via the network, potentially compromising sensitive file transfer operations and enterprise data.

Critical Impact
Unauthenticated remote attackers can leverage default credentials to gain full access to IBM Sterling Connect:Direct Web Services, potentially compromising confidentiality, integrity, and availability of enterprise file transfer infrastructure.

Affected Products

IBM Sterling Connect:Direct Web Services 6.0
IBM Sterling Connect:Direct Web Services 6.1
IBM Sterling Connect:Direct Web Services 6.2
IBM Sterling Connect:Direct Web Services 6.3

The vulnerability affects deployments on IBM AIX, Linux, and Microsoft Windows operating systems.

Discovery Timeline

2024-08-31 - CVE-2024-39747 published to NVD
2024-09-16 - Last updated in NVD database

Technical Details for CVE-2024-39747

Vulnerability Analysis

This vulnerability is classified under CWE-1392 (Use of Default Credentials), a configuration and design flaw that represents a significant security risk in enterprise environments. IBM Sterling Connect:Direct Web Services is a critical component used by organizations for secure managed file transfer (MFT) operations, making this vulnerability particularly concerning for enterprises that rely on this infrastructure for sensitive data exchange.

The use of default credentials in production systems creates an easily exploitable attack surface. Attackers do not need sophisticated techniques or specialized tools—they simply need knowledge of the default credentials, which are often publicly documented or easily discoverable through reconnaissance. Once authenticated, attackers gain the same privileges as legitimate users or administrators, depending on the default account's permission level.

Root Cause

The root cause of CVE-2024-39747 is the use of hardcoded or default credentials within IBM Sterling Connect:Direct Web Services. This design flaw means that out-of-the-box installations may ship with predictable authentication credentials that are not required to be changed during initial deployment or configuration. Organizations that fail to modify these default credentials during installation leave their systems exposed to trivial authentication bypass attacks.

Attack Vector

The attack vector for this vulnerability is network-based and requires no prior authentication or user interaction. An attacker with network access to the IBM Sterling Connect:Direct Web Services interface can attempt authentication using known default credentials. Successful exploitation grants the attacker unauthorized access to the web services interface, enabling them to:

Access and manipulate file transfer configurations
View or exfiltrate sensitive data in transit
Modify transfer schedules and destinations
Potentially pivot to connected systems within the enterprise network
Disrupt critical business file transfer operations

The vulnerability is particularly dangerous because it requires no special privileges or complex exploitation chains—an attacker simply needs network connectivity to the vulnerable service and knowledge of the default credentials.

Detection Methods for CVE-2024-39747

Indicators of Compromise

Successful authentication events from unexpected or external IP addresses to Sterling Connect:Direct Web Services
Multiple login attempts or successful authentications using default account names
Unusual file transfer activity patterns or unauthorized configuration changes
Access to administrative functions from non-administrative workstations or locations

Detection Strategies

Implement authentication logging and monitoring for IBM Sterling Connect:Direct Web Services with alerts on successful logins from unknown sources
Deploy network intrusion detection rules to identify authentication attempts using known default credential patterns
Configure SIEM rules to correlate authentication events with threat intelligence feeds and known malicious IP addresses
Conduct periodic credential audits to identify any accounts still using default or weak passwords

Monitoring Recommendations

Enable verbose logging on Sterling Connect:Direct Web Services and forward logs to a centralized SIEM platform
Monitor for configuration changes to user accounts, file transfer paths, and connection settings
Implement baseline behavioral analysis to detect anomalous access patterns to the web services interface
Set up alerts for any new user account creation or privilege escalation activities

How to Mitigate CVE-2024-39747

Immediate Actions Required

Immediately change all default credentials on IBM Sterling Connect:Direct Web Services installations to strong, unique passwords
Restrict network access to the web services interface using firewall rules and network segmentation
Review access logs for any signs of unauthorized access or suspicious authentication activity
Implement multi-factor authentication if supported by your deployment configuration

Patch Information

IBM has released security updates to address this vulnerability. Administrators should apply the latest patches available from IBM. For detailed patch instructions and download links, refer to the IBM Security Patch Information page. Additional vulnerability details are available through the IBM X-Force Vulnerability #297314 database.

Organizations running IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, or 6.3 should prioritize this update given the critical severity and ease of exploitation.

Workarounds

Change all default credentials immediately to complex, unique passwords following enterprise password policy requirements
Implement network-level access controls to limit connectivity to the web services interface to authorized management networks only
Deploy a web application firewall (WAF) or reverse proxy to add an additional authentication layer
Consider disabling the web services interface entirely if not required for operations until patches can be applied
Enable account lockout policies to mitigate brute-force attempts against any remaining default or weak credentials

bash

# Configuration example - Network access restriction
# Add firewall rules to restrict access to Sterling Connect:Direct Web Services
# Allow only authorized management network (example: 10.0.100.0/24)
iptables -A INPUT -p tcp --dport 8443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP