SB2024101013 - Multiple vulnerabilities in IBM Business Automation Workflow
Published: October 10, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2024-43796)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in response.redirect() method. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Input validation error (CVE-ID: CVE-2024-37372)
The vulnerability allows a remote user to bypass permissions model.
The vulnerability exists due to insufficient validation of UNC paths with backslashes. A remote user can bypass certain security restrictions.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22020)
The disclosed vulnerability allows a remote user to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when handling non-network imports in data URLs. A remote user can bypass network import restrictions and execute arbitrary code.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-22018)
The vulnerability allows a remote user to bypass permissions model.
The vulnerability exists due to application does not properly impose security restrictions when experimental permission model when the --allow-fs-read flag is used. A remote user can retrieve stats from files that they do not have explicit read access to.
5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-36137)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to application does not properly impose security restrictions in the experimental permission model when the --allow-fs-write flag is used. A remote user can change file ownership and permissions via fs.fchown and fs.fchmod.
6) Command Injection (CVE-ID: CVE-2024-36138)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync on Windows. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.
Note, the vulnerability exists due to incomplete fix for #VU88462 (CVE-2024-27980).
Remediation
Install update from vendor's website.