CVE-2024-39747: IBM Sterling Connect Direct Auth Bypass

CVE-2024-39747 Overview

IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, and 6.3 contain a critical vulnerability where the application uses default credentials for potentially critical functionality. This hardcoded credentials vulnerability allows unauthenticated attackers to gain unauthorized access to the system via the network, potentially compromising sensitive file transfer operations and enterprise data.

Critical Impact

Unauthenticated remote attackers can leverage default credentials to gain full access to IBM Sterling Connect:Direct Web Services, potentially compromising confidentiality, integrity, and availability of enterprise file transfer infrastructure.

Affected Products

• IBM Sterling Connect:Direct Web Services 6.0
• IBM Sterling Connect:Direct Web Services 6.1
• IBM Sterling Connect:Direct Web Services 6.2
• IBM Sterling Connect:Direct Web Services 6.3

The vulnerability affects deployments on IBM AIX, Linux, and Microsoft Windows operating systems.

Discovery Timeline

• 2024-08-31 - CVE-2024-39747 published to NVD
• 2024-09-16 - Last updated in NVD database

Technical Details for CVE-2024-39747

Vulnerability Analysis

This vulnerability is classified under CWE-1392 (Use of Default Credentials), a configuration and design flaw that represents a significant security risk in enterprise environments. IBM Sterling Connect:Direct Web Services is a critical component used by organizations for secure managed file transfer (MFT) operations, making this vulnerability particularly concerning for enterprises that rely on this infrastructure for sensitive data exchange.

The use of default credentials in production systems creates an easily exploitable attack surface. Attackers do not need sophisticated techniques or specialized tools—they simply need knowledge of the default credentials, which are often publicly documented or easily discoverable through reconnaissance. Once authenticated, attackers gain the same privileges as legitimate users or administrators, depending on the default account's permission level.

Root Cause

The root cause of CVE-2024-39747 is the use of hardcoded or default credentials within IBM Sterling Connect:Direct Web Services. This design flaw means that out-of-the-box installations may ship with predictable authentication credentials that are not required to be changed during initial deployment or configuration. Organizations that fail to modify these default credentials during installation leave their systems exposed to trivial authentication bypass attacks.

Attack Vector

The attack vector for this vulnerability is network-based and requires no prior authentication or user interaction. An attacker with network access to the IBM Sterling Connect:Direct Web Services interface can attempt authentication using known default credentials. Successful exploitation grants the attacker unauthorized access to the web services interface, enabling them to:

• Access and manipulate file transfer configurations
• View or exfiltrate sensitive data in transit
• Modify transfer schedules and destinations
• Potentially pivot to connected systems within the enterprise network
• Disrupt critical business file transfer operations

The vulnerability is particularly dangerous because it requires no special privileges or complex exploitation chains—an attacker simply needs network connectivity to the vulnerable service and knowledge of the default credentials.

Detection Methods for CVE-2024-39747

Indicators of Compromise

• Successful authentication events from unexpected or external IP addresses to Sterling Connect:Direct Web Services
• Multiple login attempts or successful authentications using default account names
• Unusual file transfer activity patterns or unauthorized configuration changes
• Access to administrative functions from non-administrative workstations or locations

Detection Strategies

• Implement authentication logging and monitoring for IBM Sterling Connect:Direct Web Services with alerts on successful logins from unknown sources
• Deploy network intrusion detection rules to identify authentication attempts using known default credential patterns
• Configure SIEM rules to correlate authentication events with threat intelligence feeds and known malicious IP addresses
• Conduct periodic credential audits to identify any accounts still using default or weak passwords

Monitoring Recommendations

• Enable verbose logging on Sterling Connect:Direct Web Services and forward logs to a centralized SIEM platform
• Monitor for configuration changes to user accounts, file transfer paths, and connection settings
• Implement baseline behavioral analysis to detect anomalous access patterns to the web services interface
• Set up alerts for any new user account creation or privilege escalation activities

How to Mitigate CVE-2024-39747

Immediate Actions Required

• Immediately change all default credentials on IBM Sterling Connect:Direct Web Services installations to strong, unique passwords
• Restrict network access to the web services interface using firewall rules and network segmentation
• Review access logs for any signs of unauthorized access or suspicious authentication activity
• Implement multi-factor authentication if supported by your deployment configuration

Patch Information

IBM has released security updates to address this vulnerability. Administrators should apply the latest patches available from IBM. For detailed patch instructions and download links, refer to the IBM Security Patch Information page. Additional vulnerability details are available through the IBM X-Force Vulnerability #297314 database.

Organizations running IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, or 6.3 should prioritize this update given the critical severity and ease of exploitation.

Workarounds

• Change all default credentials immediately to complex, unique passwords following enterprise password policy requirements
• Implement network-level access controls to limit connectivity to the web services interface to authorized management networks only
• Deploy a web application firewall (WAF) or reverse proxy to add an additional authentication layer
• Consider disabling the web services interface entirely if not required for operations until patches can be applied
• Enable account lockout policies to mitigate brute-force attempts against any remaining default or weak credentials

# Configuration example - Network access restriction
# Add firewall rules to restrict access to Sterling Connect:Direct Web Services
# Allow only authorized management network (example: 10.0.100.0/24)
iptables -A INPUT -p tcp --dport 8443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP