CVE-2024-22319
published 2024-02-02CVE-2024-22319: IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
76.40%
99.5th percentile
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends a GET request to /decisioncenter-api/v1/about with a `datasource` query parameter containing an LDAP URI pointing to an attacker-controlled server; monitor for outbound LDAP/DNS callbacks triggered by this endpoint. ↗
- →Successful exploitation is confirmed when the server responds HTTP 200 with Content-Type application/json and a body containing `patchLevel":` — combined with an out-of-band DNS callback from the injected LDAP URL. ↗
- →Identify exposed IBM ODM instances via Shodan/FOFA using HTML fingerprints `IBM ODM` or `ibm odm` in page titles/bodies before targeting the vulnerable API endpoint. ↗
- →The vulnerability is unauthenticated (PR:N, UI:N); no session or credentials are required to reach the vulnerable API, so any GET to /decisioncenter-api/v1/about with a `datasource` parameter containing an LDAP/RMI URI should be treated as a high-fidelity attack signal. ↗
- ·Affected versions are specifically 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1, and 8.12.0.1; detections should be scoped to these versions to reduce false positives. ↗
- ·Detection relies on out-of-band DNS/LDAP callback (interactsh); passive network monitoring alone (without an OOB listener) will not confirm exploitation — pair with WAF/proxy logs inspecting the `datasource` query parameter value for ldap://, rmi://, or similar JNDI schemes. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x4hh-7hpg-jmcg: IBM Operational Decision Manager 8
ghsa_unreviewed·2024-02-02
CVE-2024-22319 [HIGH] CWE-74 GHSA-x4hh-7hpg-jmcg: IBM Operational Decision Manager 8
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote attacker to conduct an LDAP injection. By sending a request with a specially crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter. IBM X-Force ID: 279145.
VulnCheck
IBM operational_decision_manager Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
vulncheck·2024·CVSS 8.1
CVE-2024-22319 [HIGH] IBM operational_decision_manager Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
IBM operational_decision_manager Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
Affected: IBM operational_decision_manager
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-17&host_type=src&vulnerability=cve-2024-22319; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/
No detection rules found.
Nuclei
IBM Operational Decision Manager - JNDI Injection
nuclei·CVSS 9.8
CVE-2024-22319 [CRITICAL] IBM Operational Decision Manager - JNDI Injection
IBM Operational Decision Manager - JNDI Injection
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
Template:
id: CVE-2024-22319
info:
name: IBM Operational Decision Manager - JNDI Injection
author: DhiyaneshDK
severity: critical
description: |
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
impact: |
Unauthenticated attackers can execute arbitrary code via JNDI injection, potentially compromising the entire IBM ODM system.
reme
No writeups or analysis indexed.
2024-02-02
Published
Exploited in the wild