CVE-2024-45647: IBM Security Verify Access Auth Bypass

CVE-2024-45647 Overview

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 contain an authentication bypass vulnerability that could allow an unverified user to change the password of an expired user without prior knowledge of that password. This flaw represents a significant security risk in enterprise identity and access management deployments, as it undermines the fundamental authentication controls that protect user accounts.

Critical Impact

An unauthenticated attacker could take over expired user accounts by resetting passwords without any prior authentication, potentially leading to unauthorized access to sensitive systems and data protected by IBM Security Verify Access.

Affected Products

• IBM Security Verify Access 10.0.0 through 10.0.8
• IBM Security Verify Access Docker 10.0.0 through 10.0.8

Discovery Timeline

• 2025-01-20 - CVE-2024-45647 published to NVD
• 2025-01-29 - Last updated in NVD database

Technical Details for CVE-2024-45647

Vulnerability Analysis

This vulnerability falls under CWE-620 (Unverified Password Change), which describes scenarios where an application allows users to change passwords without properly verifying the original password or user identity. In the context of IBM Security Verify Access, the flaw specifically affects the password change functionality for expired user accounts.

The issue is particularly concerning because it targets accounts in an expired state—a condition that should inherently require additional verification before allowing any credential modifications. Instead of enforcing proper authentication checks, the vulnerable versions permit password changes without validating the requester's identity or knowledge of the existing credentials.

Root Cause

The root cause stems from improper validation in the password change workflow for expired accounts. When a user account expires, the password change mechanism fails to enforce proper authentication checks, creating a bypass condition. The application does not adequately verify that the party requesting the password change has legitimate authority to do so, violating the principle of proper identity verification before credential modification.

Attack Vector

This vulnerability is exploitable over the network without requiring any prior authentication or user interaction. An attacker can target expired user accounts directly by leveraging the flawed password change functionality.

The attack scenario involves:

1. Identifying or enumerating expired user accounts within the IBM Security Verify Access deployment
2. Initiating a password change request for the target expired account
3. Setting a new password without providing the original credentials
4. Gaining unauthorized access to the compromised account

The network-based attack vector combined with no authentication requirements makes this vulnerability highly exploitable in environments where IBM Security Verify Access is exposed to untrusted networks.

Detection Methods for CVE-2024-45647

Indicators of Compromise

• Unexpected password change events for expired user accounts without corresponding legitimate authentication attempts
• Multiple password reset requests targeting expired accounts from unusual source IP addresses
• Audit log entries showing password modifications without valid session tokens or prior authentication
• Sudden reactivation of previously expired accounts followed by suspicious login activity

Detection Strategies

• Monitor authentication logs for password change operations that lack proper authentication context
• Implement alerting rules for any password modifications on accounts with expired status
• Review access logs for unusual patterns targeting the password change endpoints
• Cross-reference password change events with legitimate user activity timelines

Monitoring Recommendations

• Enable comprehensive logging for all password management operations in IBM Security Verify Access
• Configure SIEM rules to flag password changes for expired accounts as high-priority alerts
• Establish baseline metrics for normal password change volumes and alert on anomalies
• Implement real-time monitoring of the password change API endpoints for suspicious activity patterns

How to Mitigate CVE-2024-45647

Immediate Actions Required

• Upgrade IBM Security Verify Access to the latest patched version immediately
• Review audit logs for any suspicious password change activity targeting expired accounts
• Reset passwords for any expired accounts that show signs of unauthorized modification
• Consider temporarily disabling password change functionality for expired accounts until patching is complete

Patch Information

IBM has released security updates to address this vulnerability. Administrators should apply the patches provided by IBM as documented in the IBM Security Advisory. The fix addresses the authentication bypass by implementing proper verification checks before allowing password changes for expired accounts.

Organizations running affected versions (10.0.0 through 10.0.8) of either IBM Security Verify Access or IBM Security Verify Access Docker should prioritize this update given the critical nature of the vulnerability.

Workarounds

• Implement network segmentation to limit access to IBM Security Verify Access management interfaces
• Deploy additional authentication layers such as multi-factor authentication in front of the affected systems
• Configure web application firewalls to inspect and potentially block suspicious password change requests
• Disable or restrict access to password change functionality for expired accounts through custom access policies until patches can be applied
• Monitor and alert on all password change attempts as an interim detection measure

# Example: Verify current IBM Security Verify Access version
# Check system version to determine patch status
isvaadmin version

# Review authentication audit logs for suspicious activity
# Look for password change events without proper authentication
grep "password_change" /var/log/isva/audit.log | grep "expired_account"