CVE-2024-56344: IBM Cognos Analytics HSTS Information Leak

CVE-2024-56344 Overview

CVE-2024-56344 is an information disclosure vulnerability in IBM Cognos Analytics. The flaw affects versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1. IBM Cognos Analytics fails to properly enable HTTP Strict Transport Security (HSTS), leaving encrypted sessions vulnerable to protocol downgrade. A remote attacker positioned on the network path can use man-in-the-middle techniques to intercept sensitive data. The weakness is categorized under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm).

Critical Impact
An attacker performing a man-in-the-middle attack can strip TLS and capture sensitive analytics data, credentials, or session tokens transmitted between users and the Cognos Analytics server.

Affected Products

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1
Deployments exposing Cognos web interfaces over untrusted networks

Discovery Timeline

2026-09-18 - CVE-2024-56344 published to the National Vulnerability Database
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2024-56344

Vulnerability Analysis

IBM Cognos Analytics does not enforce HTTP Strict Transport Security response headers on affected releases. Without the Strict-Transport-Security header, browsers cannot pin future requests to HTTPS. An attacker on the same network segment can intercept the initial cleartext HTTP request and downgrade the connection. The result is exposure of confidential analytics content, authentication cookies, and business intelligence data traversing the session.

Root Cause

The root cause is a missing security control in the HTTP response pipeline. The Cognos Analytics web tier does not emit the Strict-Transport-Security header on responses to browser clients. This omission conflicts with the transport security requirements expected of enterprise BI platforms and maps to CWE-327 in the NVD record.

Attack Vector

Exploitation requires network-adjacent positioning between a legitimate Cognos user and the server. Common scenarios include compromised Wi-Fi networks, ARP spoofing on internal segments, or rogue upstream proxies. The attacker intercepts the user's first request to the Cognos hostname over HTTP and prevents the redirect to HTTPS. Tools such as sslstrip and mitmproxy automate this downgrade. Once the session is unencrypted, the attacker reads or modifies data in transit, including session identifiers used to impersonate the victim.

No proof-of-concept exploit code has been published for this specific CVE. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2024-56344

Indicators of Compromise

HTTP requests to the Cognos Analytics hostname on port 80 that do not receive a 301/308 redirect to HTTPS
Absence of the Strict-Transport-Security header in responses from the Cognos web tier
Unexpected ARP table changes or duplicate MAC addresses on network segments serving Cognos clients
Client browser sessions negotiating downgraded TLS versions or cleartext HTTP to the analytics endpoint

Detection Strategies

Scan Cognos endpoints with curl -I https://<cognos-host> and confirm whether the Strict-Transport-Security header is present
Compare deployed Cognos Analytics build numbers against the vulnerable ranges 12.0.4–12.0.4 FP2 and 12.1.0–12.1.3 FP1
Inspect web application firewall and reverse proxy logs for cleartext HTTP traffic to Cognos virtual hosts

Monitoring Recommendations

Alert on TLS downgrade patterns and unexpected cleartext sessions to Cognos Analytics hosts
Monitor for man-in-the-middle indicators on internal networks, including ARP anomalies and DNS response tampering
Track authentication anomalies in Cognos audit logs that may indicate replayed or hijacked session tokens

How to Mitigate CVE-2024-56344

Immediate Actions Required

Inventory all IBM Cognos Analytics deployments and identify instances running 12.0.4 through 12.0.4 FP2 or 12.1.0 through 12.1.3 FP1
Apply the fixed version published by IBM as referenced in the IBM Support Page
Restrict Cognos Analytics access to trusted network segments or VPN-only reachability until patched
Force HTTPS-only listeners at the load balancer or reverse proxy in front of Cognos

Patch Information

IBM has published remediation guidance and fixed builds. Refer to the vendor advisory at the IBM Support Page for the exact fix pack and upgrade path applicable to each affected release train.

Workarounds

Configure an upstream reverse proxy (for example, NGINX, F5, or IBM HTTP Server) to inject a Strict-Transport-Security response header with a long max-age
Disable HTTP listeners on the Cognos web tier and permit only TLS 1.2 or TLS 1.3 connections
Deploy HSTS preload configuration for internal DNS zones where feasible to block first-connection downgrade
Enforce certificate pinning or mutual TLS for automated Cognos API consumers

bash

# Example NGINX reverse proxy configuration to enforce HSTS in front of Cognos Analytics
server {
    listen 443 ssl http2;
    server_name cognos.example.com;

    ssl_protocols TLSv1.2 TLSv1.3;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    location / {
        proxy_pass https://cognos-backend.internal;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}

server {
    listen 80;
    server_name cognos.example.com;
    return 308 https://$host$request_uri;
}