CVE-2024-41787: IBM DOORS Next RCE Vulnerability

CVE-2024-41787 Overview

CVE-2024-41787 is a race condition vulnerability affecting IBM Engineering Requirements Management DOORS Next versions 7.0.2 and 7.0.3. A remote attacker can send a specially crafted request to bypass security restrictions and execute code on the affected system. The flaw is classified under CWE-367, Time-of-Check Time-of-Use (TOCTOU) race condition. IBM has published a security advisory and patch through its support portal.

Critical Impact

Successful exploitation enables remote code execution on DOORS Next servers without authentication, compromising confidentiality, integrity, and availability of requirements management data.

Affected Products

• IBM Engineering Requirements Management DOORS Next 7.0.2
• IBM Engineering Requirements Management DOORS Next 7.0.3
• CPE: cpe:2.3:a:ibm:doors_next

Discovery Timeline

• 2025-01-10 - CVE-2024-41787 published to NVD
• 2025-08-20 - Last updated in NVD database

Technical Details for CVE-2024-41787

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in IBM DOORS Next. The application checks a security-relevant condition at one point in execution, then uses the result of that check at a later point. An attacker who interleaves requests during the gap between check and use can invalidate the security assumption and bypass restrictions.

The outcome of winning the race is remote code execution. The attacker does not need valid credentials, since the attack vector is network-based with no privileges required. Exploitation requires precise timing, which raises the attack complexity but does not preclude practical attacks against high-value targets.

Root Cause

The root cause is non-atomic handling of a security check inside DOORS Next request processing. The protected resource or operation is validated, but the validation result remains valid across a window during which a concurrent request can alter the underlying state. IBM has not published low-level details of the affected component. Refer to the IBM Support Node Advisory for vendor guidance.

Attack Vector

The vulnerability is exploited remotely over the network against the DOORS Next web interface. An attacker sends concurrent crafted requests that target the racy code path. When the race is won, server-side logic executes attacker-controlled operations leading to code execution in the context of the DOORS Next service account.

No public proof-of-concept code is available. The vulnerability is described in prose by IBM without exploitation details.

Detection Methods for CVE-2024-41787

Indicators of Compromise

• Bursts of near-simultaneous HTTP requests to the same DOORS Next endpoint from a single source, consistent with race condition exploitation attempts.
• Unexpected child processes spawned by the DOORS Next Java application server (jazz, tomcat, or WebSphere Liberty workers).
• Outbound connections from DOORS Next servers to untrusted external hosts following anomalous request bursts.
• New or modified files in DOORS Next deployment directories outside of scheduled maintenance windows.

Detection Strategies

• Monitor web access logs for high-rate parallel requests targeting identical DOORS Next URLs within sub-second windows.
• Alert on process creation events where the DOORS Next service user spawns shell interpreters such as cmd.exe, powershell.exe, bash, or sh.
• Compare running DOORS Next binaries and configuration files against a known-good baseline to detect tampering.

Monitoring Recommendations

• Forward DOORS Next application logs, web server logs, and host process telemetry to a centralized SIEM for correlation.
• Track authentication events and administrative actions on DOORS Next servers, flagging activity that lacks a corresponding interactive login.
• Apply network segmentation monitoring to detect lateral movement from DOORS Next servers into adjacent engineering and source control systems.

How to Mitigate CVE-2024-41787

Immediate Actions Required

• Apply the IBM-supplied fix referenced in the IBM Support Node Advisory for DOORS Next 7.0.2 and 7.0.3.
• Restrict network access to DOORS Next interfaces so they are reachable only from trusted internal networks and VPN ranges.
• Review DOORS Next servers for the indicators of compromise listed above before and after patching.
• Rotate service account credentials and API tokens used by DOORS Next if compromise is suspected.

Patch Information

IBM has issued a security bulletin for CVE-2024-41787 covering DOORS Next 7.0.2 and 7.0.3. Administrators should consult the IBM Support Node Advisory for the specific interim fix or upgrade package corresponding to their deployment, then validate the fix in a staging environment before production rollout.

Workarounds

• Place a web application firewall in front of DOORS Next and rate-limit concurrent requests to the same endpoint from individual sources.
• Disable or restrict access to non-essential DOORS Next endpoints until the patch is applied.
• Run the DOORS Next service under a least-privilege account to limit the impact of successful code execution.

# Example: restrict DOORS Next access to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 9443 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP