CVE-2016-9972

Vulnerability

IBM QRadar SIEM versions 7.2.0 through 7.2.8 Patch 6 and 7.3.0 through 7.3.0 Patch 1 do not properly enable HTTP Strict Transport Security (HSTS) [1]. When a user accesses the web interface, the server fails to send the Strict-Transport-Security header, allowing the browser to fall back to unencrypted HTTP or accept invalid TLS certificates [1]. This configuration flaw stems from missing security hardening in the application server settings [1].

Exploitation

An attacker with network access between the user and the QRadar server can perform a man-in-the-middle (MITM) attack [1]. The attacker can intercept a victim's initial HTTP request or redirect a victim from an HTTPS page to HTTP, or present a forged certificate that would normally be rejected [1]. Because HSTS is absent, the user's browser does not force a secure connection, and the attacker can capture login credentials, session tokens, or other sensitive data transmitted in cleartext [1]. No authentication or special privileges are required for the attacker beyond the ability to intercept and modify network traffic [1].

Impact

Successful exploitation results in the disclosure of sensitive information transmitted between the user and the QRadar web interface [1]. This can include administrator credentials, configuration data, and other confidential information [1]. The compromise is limited to data in transit; the attacker does not gain direct access to the QRadar system or persistent privileges unless further attacks are conducted using the stolen data [1]. The Confidentiality impact is High, while Integrity and Availability are not affected according to the CVSS vector [1].

Mitigation

IBM has not released a specific patch or workaround for this issue, as noted in the references [1]. The recommended mitigation is to ensure strict use of HTTPS and to implement HSTS at the reverse proxy or load balancer level if one is deployed in front of QRadar [1]. Administrators should also enforce certificate validation and disable HTTP access entirely on the QRadar appliance [1]. Users should be instructed to always type the full HTTPS URL and not bypass certificate warnings [1].