CVE-2024-6834: Imperative Local Command Injection allows Activity Masking
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
APIML Spring Cloud Gatewayto a version that resolves this vulnerability.Fixed in 2.14.4Patch https://github.com/zowe/api-layer/pull/3203 - Upgrade
Upgrade
APIML Spring Cloud Gatewayto a version that resolves this vulnerability.Patch https://github.com/zowe/api-layer/pull/3273 - Compensating control
Until upgraded, ensure endpoints that require an internal client certificate are not reachable by unauthorized users (prevent access to endpoints requiring an internal client certificate without credentials).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6834?
CVE-2024-6834 is categorized as a high severity vulnerability due to its potential to allow unauthorized access to sensitive endpoints.
How do I fix CVE-2024-6834?
To mitigate CVE-2024-6834, it is recommended to update the Zowe APIML Spring Cloud Gateway to the latest version that addresses this vulnerability.
What systems are affected by CVE-2024-6834?
CVE-2024-6834 affects the Zowe APIML Spring Cloud Gateway, particularly those implementations using client certificates.
What exploits are possible with CVE-2024-6834?
Exploitation of CVE-2024-6834 can lead to unauthorized access to protected endpoints, bypassing authentication mechanisms.
Who is responsible for addressing CVE-2024-6834?
The responsibility to address CVE-2024-6834 primarily falls on users and administrators of Zowe APIML Spring Cloud Gateway to implement necessary updates and security measures.