CVE-2024-55907: IBM Cognos Analytics Mobile Information Disclosure

CVE-2024-55907 Overview

CVE-2024-55907 affects the IBM Cognos Analytics Mobile 1.1 application for iOS. The application uses weak obfuscation, allowing an attacker to reverse engineer the compiled codebase. Successful analysis reveals programming techniques, interfaces, class definitions, algorithms, and internal functions. This information disclosure weakness is tracked as [CWE-540] (Inclusion of Sensitive Information in Source Code).

The issue does not directly compromise data integrity or availability. However, attackers can use recovered internal details to plan follow-on attacks against the mobile client or its backend services.

Critical Impact
Reverse engineering of the iOS binary exposes proprietary logic and implementation details that attackers can leverage to craft targeted exploits against IBM Cognos Analytics environments.

Affected Products

IBM Cognos Analytics Mobile 1.1 for iOS
Deployments distributed through the Apple App Store prior to the vendor fix
Enterprise environments integrating the mobile client with IBM Cognos Analytics backends

Discovery Timeline

2025-03-02 - CVE-2024-55907 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55907

Vulnerability Analysis

The vulnerability stems from insufficient code obfuscation in the compiled iOS application. Mobile binaries distributed to end-user devices are inherently accessible to attackers who install and inspect them. Without strong obfuscation, static and dynamic analysis tools can recover meaningful symbols, class hierarchies, and control flow.

An attacker with access to the .ipa package can extract the Mach-O binary and analyze it using standard tooling such as disassemblers and decompilers. Weak obfuscation makes function names, class definitions, and algorithmic logic legible. The recovered information includes interface definitions, internal API endpoints, and business-logic routines used by the client.

The attack is network-based in scoring terms because the recovered knowledge is typically weaponized against the network-exposed backend. Confidentiality of implementation details is affected, while integrity and availability are not directly impacted.

Root Cause

The root cause is the absence or weakness of code obfuscation controls in the iOS build. Symbol stripping, string encryption, and control-flow flattening were not applied at a strength sufficient to resist reverse engineering by a motivated analyst.

Attack Vector

An attacker obtains the iOS application from a distribution channel or a device. They decrypt the binary if needed, then apply static analysis with tools such as Hopper, Ghidra, or IDA Pro. Dynamic instrumentation frameworks such as Frida can supplement static work at runtime.

The recovered artifacts inform targeted probing of the IBM Cognos Analytics backend and the client's local data handling. No prior authentication or user interaction is required to perform the analysis.

See the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2024-55907

Indicators of Compromise

Unexpected downloads or extractions of the IBM Cognos Analytics Mobile .ipa package from corporate distribution points
Backend request patterns that mirror internal client-only API paths, suggesting an attacker has enumerated them from reverse-engineered code
Access from jailbroken devices or unmanaged endpoints attempting to communicate with the Cognos backend

Detection Strategies

Monitor mobile device management (MDM) logs for installations of outdated Cognos Analytics Mobile versions
Inspect backend web application firewall (WAF) logs for atypical API sequences that suggest knowledge of internal client routines
Correlate authentication anomalies with mobile client versions reported by MDM inventory

Monitoring Recommendations

Track the version distribution of IBM Cognos Analytics Mobile across the fleet and alert on unpatched installs
Enable telemetry for unusual API calls to Cognos backends and baseline normal mobile client traffic
Log and review access from unmanaged or jailbroken iOS devices attempting to reach enterprise analytics services

How to Mitigate CVE-2024-55907

Immediate Actions Required

Identify all iOS devices running IBM Cognos Analytics Mobile 1.1 using MDM inventory
Upgrade to the fixed version referenced in the vendor advisory as soon as it is available through the App Store
Restrict backend access so that only current, patched client versions can authenticate

Patch Information

Refer to the IBM Support Page for the vendor advisory, fixed version details, and upgrade guidance for IBM Cognos Analytics Mobile.

Workarounds

Enforce MDM policies that block installation of the vulnerable version and require the patched release
Restrict Cognos Analytics Mobile use to managed, non-jailbroken iOS devices
Apply conditional access controls at the backend that validate client version and device posture before granting API access
Rotate any secrets or endpoint identifiers that may have been recoverable from the affected binary