CVE-2024-22320
published 2024-02-02CVE-2024-22320: IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe…
PriorityP189high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
73.40%
99.4th percentile
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
| ibm | operational_decision_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit targets the javax.faces.ViewState parameter on /res/login.jsf with a serialized Java gadget payload (base64-encoded). Detect HTTP GET requests to this endpoint where ViewState contains a deserialization payload. ↗
- →A successful exploit attempt results in an HTTP 500 response containing 'javax.servlet.ServletException' in the response body — use this as a positive indicator of a triggered deserialization error. ↗
- →Identify IBM ODM instances exposed on the internet using Shodan query 'html:"IBM ODM"' or FOFA query 'title="IBM ODM"' — these are candidate targets for CVE-2024-22320. ↗
- →The attack vector is a remote authenticated GET request with a Java deserialization gadget embedded in the javax.faces.ViewState query parameter, exploiting unsafe JSF ViewState deserialization in IBM ODM versions 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1. ↗
- ·Exploitation requires authentication — the attacker must be a remote authenticated user. Unauthenticated scanning will not trigger the vulnerability. ↗
- ·The Nuclei template uses an out-of-band DNS interaction (interactsh) to confirm code execution; detection based solely on HTTP 500 / ServletException may produce false positives without OOB confirmation. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5pq5-cp3w-7chj: IBM Operational Decision Manager 8
ghsa_unreviewed·2024-02-02
CVE-2024-22320 [CRITICAL] CWE-502 GHSA-5pq5-cp3w-7chj: IBM Operational Decision Manager 8
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
VulnCheck
IBM operational_decision_manager Deserialization of Untrusted Data
vulncheck·2024·CVSS 9.8
CVE-2024-22320 [CRITICAL] IBM operational_decision_manager Deserialization of Untrusted Data
IBM operational_decision_manager Deserialization of Untrusted Data
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Affected: IBM operational_decision_manager
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-22&host_type=src&vulnerability=cve-2024-22320; https://dashboard.shadowserver.org/statistics/honey
No detection rules found.
Nuclei
IBM Operational Decision Manager - Java Deserialization
nuclei·CVSS 8.8
CVE-2024-22320 [HIGH] IBM Operational Decision Manager - Java Deserialization
IBM Operational Decision Manager - Java Deserialization
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Template:
id: CVE-2024-22320
info:
name: IBM Operational Decision Manager - Java Deserialization
author: DhiyaneshDK
severity: high
description: |
IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending spe
No writeups or analysis indexed.
https://exchange.xforce.ibmcloud.com/vulnerabilities/279146https://www.ibm.com/support/pages/node/7112382https://exchange.xforce.ibmcloud.com/vulnerabilities/279146https://www.ibm.com/support/pages/node/7112382https://www.vicarius.io/vsociety/posts/unveiling-cve-2024-22320-a-novices-journey-to-exploiting-java-deserialization-rce-in-ibm-odm
2024-02-02
Published
Exploited in the wild