CVE-2024-43191 Overview
CVE-2024-43191 affects IBM ManageIQ, shipped within IBM Cloud Pak for Multicloud Management Monitoring. An authenticated remote attacker can execute arbitrary commands on the underlying system by submitting a specially crafted YAML file request. The root cause is unsafe deserialization of untrusted data [CWE-502], which allows attacker-controlled objects to be instantiated during YAML parsing. Successful exploitation compromises confidentiality, integrity, and availability of the affected host. IBM has published a security advisory describing the fix and affected fix pack levels.
Critical Impact
An authenticated user can achieve arbitrary command execution on the server hosting IBM Cloud Pak for Multicloud Management Monitoring by sending a crafted YAML payload.
Affected Products
- IBM Cloud Pak for Multicloud Management Monitoring 2.3.0
- IBM Cloud Pak for Multicloud Management Monitoring 2.3.0 Fix Pack 1 through Fix Pack 8
- IBM ManageIQ component embedded within the above releases
Discovery Timeline
- 2024-09-26 - CVE-2024-43191 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43191
Vulnerability Analysis
CVE-2024-43191 is an insecure deserialization flaw in IBM ManageIQ's handling of YAML input. The application accepts YAML content from authenticated users and parses it without restricting the object types that can be constructed. YAML parsers commonly support type tags that instantiate arbitrary classes, and when those classes carry side effects on construction, deserialization becomes a command execution primitive.
The vulnerability requires only low-privilege authenticated access over the network. The attacker does not need user interaction, and the scope of impact remains within the vulnerable component while granting high impact to confidentiality, integrity, and availability. IBM assigns this issue to CWE-502, Deserialization of Untrusted Data.
Root Cause
The root cause is a YAML parsing routine that permits unrestricted tag resolution. Safe parsing modes limit deserialization to primitive types such as strings, numbers, lists, and maps. When an application uses an unsafe loader, tags such as !ruby/object or equivalent constructors let an attacker instantiate classes and invoke their initialization logic. This behavior turns a data format into an execution surface.
Attack Vector
An authenticated attacker submits a YAML file or YAML-formatted request body to an endpoint that consumes the content. The crafted payload embeds type tags referencing classes whose instantiation triggers command execution or code evaluation. Once the parser resolves the tag, the referenced constructor runs with the privileges of the ManageIQ service account, yielding shell command execution on the host.
No public proof-of-concept or exploit code is currently available for CVE-2024-43191. Consult the IBM Security Advisory for the vendor's technical description and fix guidance.
Detection Methods for CVE-2024-43191
Indicators of Compromise
- Unexpected child processes spawned by the ManageIQ application service, particularly shells or interpreters such as sh, bash, ruby, or python.
- HTTP requests containing YAML payloads with type tags such as !ruby/object, !!python/object, or other constructor tags directed at ManageIQ endpoints.
- New outbound network connections from the ManageIQ host to unfamiliar destinations shortly after YAML processing.
- Modifications to /tmp, cron entries, or SSH authorized_keys on the ManageIQ server following authenticated API activity.
Detection Strategies
- Inspect application and web server logs for POST or PUT requests carrying Content-Type: application/x-yaml or file uploads with .yaml or .yml extensions to management endpoints.
- Correlate authenticated user sessions with process creation events on the ManageIQ host to identify command execution originating from the web tier.
- Deploy rules that flag YAML documents containing non-primitive tags submitted through untrusted channels.
Monitoring Recommendations
- Enable verbose audit logging on ManageIQ API endpoints and forward logs to a centralized SIEM for retention and correlation.
- Baseline the normal process tree of the ManageIQ service and alert on deviations, especially interpreter or shell invocations.
- Monitor privileged account activity within Cloud Pak for Multicloud Management Monitoring for anomalous YAML upload patterns.
How to Mitigate CVE-2024-43191
Immediate Actions Required
- Apply the fix referenced in the IBM Security Advisory to all instances of IBM Cloud Pak for Multicloud Management Monitoring 2.3.0 and its fix packs.
- Restrict access to ManageIQ administrative and API endpoints to trusted networks and audited service accounts only.
- Rotate credentials for any accounts that could reach YAML-consuming endpoints, particularly if suspicious activity has been observed.
- Review recent authenticated sessions and file uploads for signs of exploitation before patching.
Patch Information
IBM has published remediation guidance in the vendor advisory at IBM Security Advisory 7170411. Administrators should upgrade to the fixed release identified by IBM for Cloud Pak for Multicloud Management Monitoring 2.3.0. Verify the fix pack level after installation and confirm that the ManageIQ component reports the patched version.
Workarounds
- Limit ManageIQ access to a small set of authenticated administrators until the patch is applied.
- Place the management console behind a reverse proxy or web application firewall configured to reject request bodies containing YAML type tags such as !ruby/object or !!python/object.
- Disable or remove API endpoints that accept YAML input if they are not required for operations.
- Run the ManageIQ service under a least-privilege account to reduce the impact of successful command execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
