CVE-2024-45640 Overview
IBM Security ReaQta 3.12 discloses sensitive information in HTTP responses. The exposed data can support reconnaissance and follow-on attacks against the affected system. The issue is tracked under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.
The flaw is network-reachable and requires no authentication or user interaction. IBM published a security bulletin acknowledging the issue in the IBM Support Document. The product is now branded as IBM Security QRadar EDR.
Critical Impact
An unauthenticated remote attacker can retrieve sensitive system information from HTTP responses, enabling reconnaissance for subsequent attacks against the endpoint detection and response platform.
Affected Products
- IBM Security ReaQta 3.12
- IBM Security QRadar EDR (successor branding)
- Linux kernel-based deployments running the affected version
Discovery Timeline
- 2025-01-07 - CVE-2024-45640 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45640
Vulnerability Analysis
CVE-2024-45640 is an Information Disclosure vulnerability in IBM Security ReaQta 3.12. The application returns sensitive information within HTTP responses served by the product. An unauthenticated remote attacker can retrieve this data by issuing crafted or standard HTTP requests to exposed endpoints.
The exposed information can include internal system details useful for mapping the environment. Attackers commonly leverage such disclosures to plan credential attacks, target unpatched components, or bypass defenses. Because ReaQta functions as an endpoint detection and response platform, information leaked from the console is particularly valuable to adversaries seeking to evade detection.
The vulnerability affects confidentiality only. Integrity and availability of the target system are not directly impacted by exploitation of this specific weakness.
Root Cause
The root cause maps to [CWE-497], exposure of sensitive system information to an unauthorized control sphere. The application fails to strip or redact internal data before returning HTTP responses to clients. Response headers, error content, or body fields contain information that should remain internal to the server.
Attack Vector
Exploitation requires network access to the ReaQta HTTP interface. No credentials or user interaction are required. An attacker issues HTTP requests against the exposed service and parses the returned responses for sensitive fields.
Refer to the IBM Support Document for vendor-specific technical detail on the affected endpoints and response content.
Detection Methods for CVE-2024-45640
Indicators of Compromise
- Unusual volumes of unauthenticated HTTP requests targeting the ReaQta or QRadar EDR management interface.
- HTTP responses from the platform containing internal identifiers, version banners, or configuration data reaching external clients.
- Reconnaissance patterns from a single source enumerating multiple URIs on the EDR console.
Detection Strategies
- Inspect web server and reverse proxy logs for repeated requests to the ReaQta console from non-administrative source addresses.
- Deploy web application firewall rules that flag response bodies containing sensitive system attributes leaving the network perimeter.
- Correlate HTTP access logs with authentication logs to identify unauthenticated traffic reaching authenticated endpoints.
Monitoring Recommendations
- Baseline normal administrative access to the QRadar EDR console and alert on deviations from known source subnets.
- Enable verbose HTTP logging on the ReaQta management interface and forward logs to a centralized SIEM for retention and analysis.
- Monitor egress traffic from the EDR server for anomalous response sizes that may indicate mass information harvesting.
How to Mitigate CVE-2024-45640
Immediate Actions Required
- Apply the fix referenced in the IBM Support Document for IBM Security ReaQta 3.12.
- Restrict network access to the ReaQta or QRadar EDR management interface using firewall rules or network segmentation.
- Review recent HTTP access logs for signs of prior reconnaissance targeting the affected endpoints.
Patch Information
IBM has published remediation guidance for this vulnerability. Consult the IBM Support Document for the fixed version and upgrade instructions. Customers running IBM Security ReaQta 3.12 should apply the vendor-provided update as the primary remediation.
Workarounds
- Place the ReaQta management interface behind a VPN or bastion host to eliminate direct internet exposure.
- Restrict inbound HTTP access using access control lists that permit only known administrator source addresses.
- Deploy a reverse proxy that strips or rewrites HTTP response headers and error content containing sensitive system information.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
