CVE-2024-45075: IBM webMethods Integration Privilege Escalation

CVE-2024-45075 Overview

CVE-2024-45075 is a privilege escalation vulnerability in IBM webMethods Integration 10.15. The flaw allows an authenticated user to create scheduler tasks that escalate privileges to administrator. The issue stems from missing authentication on the scheduler task creation functionality, tracked as [CWE-306: Missing Authentication for Critical Function].

IBM assigned this vulnerability a HIGH severity rating. The attack requires network access and low-privileged authentication, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected integration platform.

Critical Impact
An authenticated low-privileged user can gain full administrator control of IBM webMethods Integration 10.15 by creating scheduler tasks without proper authentication checks.

Affected Products

IBM webMethods Integration 10.15

Discovery Timeline

2024-09-04 - CVE-2024-45075 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45075

Vulnerability Analysis

CVE-2024-45075 affects the scheduler task creation function in IBM webMethods Integration 10.15. The vulnerability allows authenticated users with limited privileges to define and execute scheduler tasks that run with elevated privileges. Because the scheduler component does not enforce authorization checks on task creation, attackers can leverage this pathway to run arbitrary operations as an administrator.

The scheduler subsystem in enterprise integration platforms typically runs with elevated permissions to orchestrate long-running jobs, connectors, and integrations. When authentication or authorization enforcement is absent, any authenticated user inherits the privileges of the scheduler process itself. This transforms a benign user account into an administrative foothold on the integration server.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The scheduler task creation endpoint does not validate whether the requesting user is authorized to schedule administrative operations. IBM's advisory categorizes the issue as an authorization gap that permits vertical privilege escalation from any authenticated account.

Attack Vector

An attacker requires network access to the webMethods Integration console or API and valid low-privileged credentials. The attacker submits a crafted scheduler task definition that executes commands or workflows in the administrator context. Once the task runs, the attacker inherits administrator privileges to modify configurations, extract secrets, alter integration flows, or pivot into connected downstream systems.

Code examples are not published for this vulnerability. Refer to the IBM Support Page for vendor-supplied technical detail.

Detection Methods for CVE-2024-45075

Indicators of Compromise

Unexpected scheduler task entries created by non-administrative user accounts in webMethods Integration.
Scheduler tasks executing commands, scripts, or workflows that touch administrative configuration or credential stores.
New or modified administrator accounts following scheduler task execution by a low-privileged user.
Outbound connections from the webMethods Integration server to unfamiliar hosts after task creation events.

Detection Strategies

Audit scheduler task creation logs in webMethods Integration and correlate task owners against expected administrative users.
Compare current scheduler task inventory against a known-good baseline to identify unauthorized additions.
Alert on any scheduler task whose payload references privileged operations, credential material, or system commands.

Monitoring Recommendations

Forward webMethods Integration audit logs to a centralized SIEM or data lake for continuous review.
Monitor authentication events for low-privileged accounts that subsequently perform administrative actions.
Track process execution on the integration host for scheduler-spawned processes that deviate from documented workflows.

How to Mitigate CVE-2024-45075

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Page advisory for webMethods Integration 10.15.
Review all existing scheduler tasks and remove any created by unauthorized or unexpected accounts.
Rotate administrator credentials and integration service account secrets if unauthorized task creation is suspected.
Restrict network access to the webMethods Integration console and APIs to trusted management networks.

Patch Information

IBM published remediation guidance in security bulletin at the IBM Support Page. Administrators should apply the fix pack or upgrade specified by IBM for webMethods Integration 10.15. Verify version numbers after patching and validate that scheduler task creation now enforces authorization checks for non-administrative users.

Workarounds

Limit user account provisioning on webMethods Integration to the minimum set of users required for daily operations.
Enforce network segmentation so only administrative workstations can reach the webMethods Integration management interfaces.
Increase audit logging verbosity on scheduler operations and review logs daily until the patch is applied.

bash

# Configuration example
# Restrict management interface access at the network layer until the patch is applied.
# Example iptables rule allowing only a trusted admin subnet to reach the webMethods console port.
iptables -A INPUT -p tcp --dport 5555 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5555 -j DROP