CVE-2024-56473: IBM Aspera Shares IP Spoofing Vulnerability

CVE-2024-56473 Overview

CVE-2024-56473 affects IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6. The vulnerability allows a remote attacker to spoof a source IP address by manipulating the Client-IP HTTP header. The application writes the attacker-controlled value into log files without verifying its authenticity. This creates log integrity issues [CWE-117] and improper output neutralization for logs [CWE-116]. Attackers can obscure the true origin of malicious activity, frustrate incident response, and mislead forensic investigators. The flaw does not enable direct code execution or data disclosure but degrades the reliability of audit trails used for security monitoring.

Critical Impact
Attackers can inject arbitrary IP addresses into IBM Aspera Shares log files, breaking the chain of custody for security events and complicating attribution during investigations.

Affected Products

IBM Aspera Shares 1.9.0 through 1.10.0
IBM Aspera Shares 1.10.0 Patch Levels 1 through 6
Deployments processing HTTP requests with trusted Client-IP headers

Discovery Timeline

2025-02-05 - CVE-2024-56473 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56473

Vulnerability Analysis

IBM Aspera Shares processes incoming HTTP requests and records client source information in application logs. The application trusts the Client-IP request header when determining the origin of a request. Because HTTP headers are attacker-controlled, any remote user can insert an arbitrary value that the server writes to log entries. This weakness maps to CWE-117 (Improper Output Neutralization for Logs) and CWE-116 (Improper Encoding or Escaping of Output). The vulnerability affects log integrity rather than confidentiality or availability. Downstream tools that ingest these logs, such as SIEM platforms, correlation engines, and access review workflows, inherit the falsified data.

Root Cause

The root cause is improper verification of the Client-IP header before logging. Aspera Shares does not validate whether the header was inserted by a trusted upstream proxy or by an untrusted client. The application should derive source IP from the transport-layer connection or from a header set only by a verified reverse proxy.

Attack Vector

Exploitation requires only network access to the Aspera Shares web interface and does not require authentication or user interaction. An attacker sends an HTTP request that includes a forged Client-IP header with any chosen value. Aspera Shares writes the forged value into the log record for that request. The attacker can repeat this to attribute malicious actions to unrelated addresses or to internal hosts.

No verified public proof-of-concept is available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2024-56473

Indicators of Compromise

Log entries where the recorded Client-IP value does not match the TCP source address of the connection
Repeated requests from the same TCP peer that record widely varying Client-IP values
Client-IP values that fall inside reserved ranges (127.0.0.0/8, 10.0.0.0/8) but originate from external networks

Detection Strategies

Correlate web server access logs with upstream proxy or load balancer logs to identify header mismatches
Alert on HTTP requests to Aspera Shares that contain a Client-IP header when no trusted proxy is deployed in the path
Baseline the normal distribution of Client-IP values and flag statistical outliers

Monitoring Recommendations

Ingest Aspera Shares access logs into a centralized analytics platform for cross-source correlation
Enrich log records with the transport-layer peer address at the network boundary so investigators can compare both values
Monitor for reconnaissance patterns targeting /aspera/shares endpoints that arrive with unusual header combinations

How to Mitigate CVE-2024-56473

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support advisory
Inventory all IBM Aspera Shares installations and confirm versions between 1.9.0 and 1.10.0 PL6
Restrict access to the Aspera Shares web interface to trusted networks where feasible
Preserve historical logs before remediation to support any retroactive investigation

Patch Information

IBM has published fixed versions and remediation guidance on the IBM Support Page. Administrators should upgrade beyond IBM Aspera Shares 1.10.0 PL6 to the vendor-supplied fixed release.

Workarounds

Deploy a reverse proxy that strips or overwrites the Client-IP header before requests reach Aspera Shares
Configure downstream SIEM rules to disregard the logged Client-IP field and rely on proxy-derived source addresses
Restrict network exposure of Aspera Shares to authenticated VPN or zero-trust access paths

bash

# Example: strip Client-IP header at an nginx reverse proxy
location / {
    proxy_set_header Client-IP "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://aspera_shares_backend;
}