CVE-2024-41784: IBM Sterling Secure Proxy Path Traversal

CVE-2024-41784 Overview

CVE-2024-41784 is a directory traversal vulnerability affecting IBM Sterling Secure Proxy versions 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0. A remote, unauthenticated attacker can send a specially crafted URL containing /.../ sequences to read arbitrary files on the host system. The flaw maps to CWE-22 (Path Traversal) and CWE-32 (Improper Handling of ... Pathname). Because Sterling Secure Proxy commonly fronts B2B and managed file transfer infrastructure, exposed files may include configuration data, credentials, and sensitive business records.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the underlying server, exposing configuration, credentials, and protected data handled by the proxy.

Affected Products

IBM Sterling Secure Proxy 6.0.0.0 through 6.0.0.3
IBM Sterling Secure Proxy 6.1.0.0
Deployments exposing the management or proxy HTTP interfaces to untrusted networks

Discovery Timeline

2024-11-15 - CVE-2024-41784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41784

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of IBM Sterling Secure Proxy. The product fails to properly normalize and validate path components that contain the unusual /.../ triple-dot sequence. Standard sanitization routines often filter ../ traversal patterns but ignore ... variants, allowing attackers to escape the intended document root.

When a crafted URL is processed, the proxy resolves the manipulated path against the file system and returns the contents of files outside the authorized directory. No authentication is required, and the attack can be executed over the network with a single HTTP request. Successful exploitation discloses sensitive files such as configuration databases, key stores, log files, and operating system resources.

Root Cause

The root cause is improper handling of pathname sequences flagged by [CWE-32]. The URL parser strips or matches conventional .. segments but does not canonicalize ... patterns before performing file lookups. The defect breaks the assumption that user-supplied paths remain inside the configured web root.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker issues an HTTP GET request to the Sterling Secure Proxy listener with a URL embedding /.../ segments pointing toward a target file path. The server returns the file contents in the HTTP response body, granting confidentiality impact without altering data or service availability.

No public proof-of-concept exploit, CISA KEV listing, or Exploit-DB entry is currently associated with this CVE. The EPSS score indicates a low but non-trivial probability of exploitation activity.

Detection Methods for CVE-2024-41784

Indicators of Compromise

HTTP request URIs containing /.../ triple-dot sequences directed at Sterling Secure Proxy listeners
Web access logs showing repeated 200 OK responses for requests with unusual encoded path segments such as %2e%2e%2e/
Outbound responses returning the contents of configuration files, key stores, or /etc/ resources
Requests originating from non-business geographies or known scanning infrastructure

Detection Strategies

Inspect proxy access logs for any URI containing ... segments and correlate with response sizes inconsistent with normal traffic
Deploy web application firewall (WAF) signatures that decode and normalize paths before matching against traversal patterns
Hunt for sequential requests probing common file paths (web.xml, passwd, .properties, key store files)

Monitoring Recommendations

Forward Sterling Secure Proxy HTTP logs to a centralized SIEM for traversal pattern alerting
Baseline normal URI structures and alert on deviations involving dot-sequence repetition
Monitor file access on the proxy host for reads of sensitive files by the proxy service account outside expected paths

How to Mitigate CVE-2024-41784

Immediate Actions Required

Apply the fixed version of IBM Sterling Secure Proxy as referenced in the IBM Support advisory
Restrict network exposure of the proxy management and HTTP interfaces to trusted networks only
Rotate credentials, certificates, and keys stored on affected hosts in case of prior exposure
Audit access logs for historical exploitation attempts using ... sequences

Patch Information

IBM has released fixes addressing CVE-2024-41784. Refer to the IBM Support Page for the corrected build numbers and upgrade instructions covering 6.0.0.x and 6.1.0.0 deployments. Schedule maintenance windows and validate the patch in non-production environments before deploying to production proxies.

Workarounds

Place an upstream WAF or reverse proxy that normalizes URL paths and blocks requests containing ... or encoded equivalents
Apply network ACLs restricting inbound HTTP access to known partner IP ranges until patching completes
Run the Sterling Secure Proxy service under a least-privilege account that cannot read sensitive system files

bash

# Example WAF rule concept blocking triple-dot traversal patterns
# ModSecurity-style pseudo rule
SecRule REQUEST_URI "@rx (?:\.{3,}|%2e%2e%2e)" \
    "id:1004178,phase:1,deny,status:400,log,msg:'CVE-2024-41784 triple-dot traversal attempt'"