CVE-2024-51454: IBM Workflow Management XSS Vulnerability

CVE-2024-51454 Overview

CVE-2024-51454 is an HTTP header injection vulnerability in IBM Engineering Workflow Management. The flaw stems from improper validation of input within HTTP Host headers. Affected versions include 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004. An attacker can leverage the weakness to conduct cross-site scripting (XSS), web cache poisoning, or session hijacking against the vulnerable system. The issue is tracked under CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). The vulnerability is remotely exploitable over the network and requires no authentication or user interaction.

Critical Impact
Unauthenticated attackers can manipulate Host headers to poison caches, hijack sessions, or inject script content into responses served by IBM Engineering Workflow Management.

Affected Products

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 017
IBM Engineering Workflow Management 7.1 through 7.1 Interim Fix 004

Discovery Timeline

2026-06-22 - CVE-2024-51454 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2024-51454

Vulnerability Analysis

IBM Engineering Workflow Management fails to validate user-supplied input contained in HTTP Host headers before reflecting or consuming that data in server-side logic. When a server trusts the Host header for generating URLs, password-reset links, redirect targets, or cache keys, an attacker can substitute a malicious value and influence application behavior. The flaw aligns with [CWE-644], which covers improper neutralization of HTTP headers for downstream scripting contexts. The vulnerability has a confidentiality and integrity impact but does not affect availability.

Root Cause

The root cause is missing input validation and output neutralization on the Host request header. The application accepts arbitrary header values and uses them in contexts where structured HTTP semantics matter, such as building absolute URLs, populating links in emails, or generating cache keys. Without strict allow-list validation against expected hostnames, untrusted header content flows into security-sensitive sinks.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests with a manipulated Host header to the vulnerable Engineering Workflow Management instance. By controlling this header, the attacker can trigger several downstream effects. Cache poisoning occurs when intermediate caches store responses keyed on the manipulated header and serve attacker-controlled content to other users. Session hijacking becomes possible when password-reset or authentication flows embed the malicious host in tokens delivered to victims. Cross-site scripting arises when the unvalidated header value is reflected into HTML responses without encoding. Refer to the IBM Support Page for vendor-specific exploitation context.

Detection Methods for CVE-2024-51454

Indicators of Compromise

HTTP requests where the Host header value does not match the canonical hostname of the Engineering Workflow Management deployment.
Outbound password-reset emails or notifications containing links pointing to unexpected external domains.
Cached responses on upstream proxies or CDNs returning content correlated with anomalous Host header values.

Detection Strategies

Inspect web server and reverse-proxy access logs for requests containing Host headers that reference domains other than the approved application FQDN.
Correlate spikes in 4xx or redirect responses with malformed or duplicated Host headers from a single source.
Deploy web application firewall (WAF) rules that flag requests containing Host, X-Forwarded-Host, or X-Host headers pointing to unsanctioned domains.

Monitoring Recommendations

Centralize HTTP request logs from Engineering Workflow Management servers and enable retention sufficient for retrospective hunting.
Alert on repeated requests from the same IP using varied Host header values, a pattern consistent with cache poisoning probes.
Monitor cache-control behavior on upstream proxies and CDNs for entries keyed off untrusted header values.

How to Mitigate CVE-2024-51454

Immediate Actions Required

Apply the interim fixes published by IBM for the affected 7.0.2, 7.0.3, and 7.1 branches as documented on the IBM Support Page.
Configure the reverse proxy or load balancer in front of Engineering Workflow Management to enforce an allow-list of valid Host header values.
Audit recent application logs for evidence of Host header manipulation prior to patch deployment.

Patch Information

IBM has released fixes beyond Interim Fix 035 for 7.0.2, beyond Interim Fix 017 for 7.0.3, and beyond Interim Fix 004 for 7.1. Administrators should consult the IBM advisory linked above to obtain the appropriate interim fix package for their deployed version and apply it following IBM's documented upgrade procedure.

Workarounds

Enforce strict Host header validation at an upstream reverse proxy such as NGINX or Apache HTTPD, rejecting requests whose Host value does not match the configured server name.
Disable trust in X-Forwarded-Host, X-Host, and similar headers within the application configuration when they are not required.
Configure caching layers to include the application's canonical hostname in cache keys rather than the client-supplied Host header.

bash

# Configuration example: NGINX Host header allow-list
server {
    listen 443 ssl;
    server_name ewm.example.com;

    if ($host !~* ^(ewm\.example\.com)$ ) {
        return 444;
    }

    location / {
        proxy_set_header Host $host;
        proxy_pass https://ewm_backend;
    }
}