CVE-2024-54172: IBM Sterling B2B Integrator CSRF Vulnerability

CVE-2024-54172 Overview

IBM Sterling B2B Integrator and IBM Sterling File Gateway contain a cross-site request forgery (CSRF) vulnerability tracked as CVE-2024-54172. The flaw affects versions 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4. An attacker can trick an authenticated user into submitting unauthorized requests that the application trusts. The vulnerability is categorized under [CWE-352] and requires user interaction to succeed. IBM published a security bulletin documenting the affected releases and remediation guidance.

Critical Impact
An attacker can execute unauthorized actions in the context of an authenticated Sterling B2B Integrator or File Gateway user by convincing them to interact with attacker-controlled content.

Affected Products

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
Deployments on IBM AIX, Linux, and Microsoft Windows host operating systems

Discovery Timeline

2025-06-18 - CVE-2024-54172 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54172

Vulnerability Analysis

CVE-2024-54172 is a cross-site request forgery weakness in the web interfaces of IBM Sterling B2B Integrator and IBM Sterling File Gateway. The application accepts state-changing HTTP requests without adequately verifying that the request was intentionally submitted by the authenticated user. An attacker who lures a logged-in user to a malicious page can cause the browser to issue authenticated requests to the Sterling application. Because the target application trusts the session, it executes those requests as if the user issued them. The result is limited integrity impact with no direct impact on confidentiality or availability, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Root Cause

The underlying weakness is a missing or insufficient anti-CSRF control on sensitive endpoints. Requests that modify configuration, workflow state, or user-facing data do not require an unpredictable token that binds the request to the user's session. Without such a token, the application cannot distinguish forged cross-origin requests from legitimate same-origin requests.

Attack Vector

Exploitation requires the victim to be authenticated to Sterling B2B Integrator or Sterling File Gateway and to visit attacker-controlled content in the same browser. The attacker hosts a page containing an auto-submitting form, image tag, or script that targets a state-changing endpoint on the Sterling application. The victim's browser attaches valid session cookies to the request, and the server processes the action. No credentials or prior privileges are needed by the attacker, but user interaction is required.

No public proof-of-concept exploit is listed for CVE-2024-54172, and it is not tracked on the CISA Known Exploited Vulnerabilities catalog. See the IBM Support Documentation for technical specifics.

Detection Methods for CVE-2024-54172

Indicators of Compromise

State-changing HTTP requests to Sterling B2B Integrator or File Gateway endpoints with Referer or Origin headers pointing to unexpected external domains.
Authenticated administrative actions that occur immediately after a user navigates from an external site or opens an email link.
Unexpected configuration changes, workflow modifications, or user account updates that cannot be tied to a legitimate operator action.

Detection Strategies

Inspect reverse proxy and web server logs for POST or PUT requests whose Referer or Origin header does not match the Sterling application's own hostname.
Correlate authenticated user actions with browser navigation events to identify sessions that were manipulated cross-origin.
Alert on high-value administrative operations submitted without a prior GET to the corresponding form page in the same session.

Monitoring Recommendations

Forward Sterling B2B Integrator and File Gateway access logs to a centralized SIEM for cross-referencing with authentication events.
Baseline typical administrative activity per user and flag deviations in timing, source IP, or user agent.
Track outbound email links and web proxy traffic that route users to unknown external domains while they hold active Sterling sessions.

How to Mitigate CVE-2024-54172

Immediate Actions Required

Apply the IBM-provided fix as documented in the IBM Support Documentation for versions 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4.
Restrict administrative access to Sterling B2B Integrator and File Gateway consoles to trusted network segments.
Require administrators to use dedicated browsers or browser profiles when managing the application to reduce cross-origin exposure.

Patch Information

IBM has released updated versions addressing CVE-2024-54172. Refer to the IBM Support Documentation for the specific fix levels applicable to your deployed release and platform, whether IBM AIX, Linux, or Microsoft Windows.

Workarounds

Enforce SameSite=Strict or SameSite=Lax attributes on session cookies at the reverse proxy where supported.
Require re-authentication or step-up authentication for sensitive administrative actions.
Educate administrators to log out of Sterling consoles when not actively in use and to avoid browsing untrusted sites in the same session.

bash

# Configuration example
# Example reverse proxy header hardening for Sterling B2B Integrator (illustrative)
# Enforce SameSite on session cookies and reject cross-origin state-changing requests
Header edit Set-Cookie ^(.*)$ "$1; SameSite=Strict; Secure; HttpOnly"
SetEnvIfNoCase Origin "^https?://(?!sterling\.example\.com)" cross_origin_request
<LocationMatch "^/(gbm|myfilegateway|dashboard)/.*">
    <RequireAll>
        Require all granted
        Require not env cross_origin_request
    </RequireAll>
</LocationMatch>