CVE-2024-47109: IBM Sterling File Gateway Path Disclosure

CVE-2024-47109 Overview

CVE-2024-47109 is an information disclosure vulnerability in IBM Sterling File Gateway. The UI component can disclose the server's installation path to unauthenticated remote users. Affected versions include IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3. The weakness is categorized under [CWE-522] (Insufficiently Protected Credentials context) as tracked by IBM. Exposure of the installation path helps attackers map the server's filesystem layout and craft follow-on attacks against configuration files, logs, or protected resources.

Critical Impact
An unauthenticated network-based attacker can retrieve the server installation path through the Sterling File Gateway UI, providing reconnaissance data useful for chained attacks.

Affected Products

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6
IBM Sterling File Gateway 6.2.0.0 through 6.2.0.3
Deployments on IBM AIX, Linux, and Microsoft Windows host operating systems

Discovery Timeline

2025-03-10 - CVE-2024-47109 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47109

Vulnerability Analysis

The Sterling File Gateway UI returns server installation path data to clients that request specific resources. The disclosed path reveals directory structure information that should remain internal to the application. The impact is limited to confidentiality; integrity and availability are not affected. The attack requires no authentication, no user interaction, and can be executed over the network with low complexity. While the direct impact is limited, path disclosure often accelerates exploitation of adjacent weaknesses such as file inclusion, arbitrary file read, or credential file targeting.

Root Cause

The vulnerability stems from insufficient output sanitization in the Sterling File Gateway UI layer. Error responses, diagnostic pages, or embedded configuration references leak the absolute server installation directory. Applications should abstract internal filesystem details from any client-facing response.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the Sterling File Gateway UI endpoint. The response includes the absolute server installation path. The attacker then uses this information to target configuration files, log directories, deployment descriptors, or credential stores located relative to the disclosed path. See the IBM Support Page for vendor-provided technical details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-47109

Indicators of Compromise

HTTP responses from Sterling File Gateway UI endpoints containing absolute filesystem paths such as /opt/IBM/, /usr/local/, or C:\IBM\
Unauthenticated requests to Sterling File Gateway UI paths originating from unexpected source IPs
Repeated probing of UI endpoints followed by requests to installation-relative directories

Detection Strategies

Inspect outbound HTTP responses from Sterling File Gateway for installation path strings using a web application firewall or reverse proxy
Correlate reconnaissance patterns against Sterling File Gateway UI with subsequent requests targeting configuration or log paths
Deploy signatures that flag response bodies containing well-known IBM installation directory prefixes

Monitoring Recommendations

Enable verbose access logging on the Sterling File Gateway UI tier and forward logs to a centralized SIEM
Alert on unauthenticated HTTP 200 responses to diagnostic or error endpoints
Monitor for sequential requests that suggest filesystem enumeration following an information disclosure attempt

How to Mitigate CVE-2024-47109

Immediate Actions Required

Apply the fixed release from IBM as documented on the IBM Support Page
Restrict network access to the Sterling File Gateway UI to trusted management networks only
Review web server and application logs for prior reconnaissance activity targeting UI endpoints

Patch Information

IBM has published remediation guidance for CVE-2024-47109 covering Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3. Upgrade to the fixed version referenced in the IBM security bulletin for your deployment branch.

Workarounds

Place Sterling File Gateway behind a reverse proxy that strips absolute path strings from response bodies
Enforce network segmentation and access control lists limiting exposure of the UI to administrators
Disable or restrict any nonessential diagnostic endpoints on the Sterling File Gateway UI tier

bash

# Example reverse proxy response filtering (nginx sub_filter)
sub_filter '/opt/IBM/SterlingFileGateway' '[redacted]';
sub_filter 'C:\\IBM\\SterlingFileGateway' '[redacted]';
sub_filter_once off;
sub_filter_types text/html application/json;