CVE-2019-4686

Vulnerability

IBM Security Guardium Data Encryption (GDE) version 3.0.0.2 does not set the Secure attribute on authorization tokens or session cookies. This means cookies are transmitted over unencrypted HTTP connections, making them susceptible to interception. The vulnerability is present in the default configuration of GDE 3.0.0.2. [1]

Exploitation

An attacker can craft an HTTP link (e.g., http://example.com) and send it to a user or plant it on a site the user visits. If the user clicks the link while authenticated to GDE, the browser will send the session cookie over the insecure HTTP connection. The attacker can then sniff the network traffic to capture the cookie value. No authentication or special privileges are required for the attacker beyond network access to observe the traffic.

Impact

Successful exploitation allows the attacker to obtain the session cookie of an authenticated user. This can lead to unauthorized access to the GDE application, potentially compromising sensitive data managed by the encryption solution. The impact is information disclosure and session hijacking, with the attacker gaining the privileges of the victim user.

Mitigation

IBM has released a fix for this vulnerability. According to the security bulletin [1], users should upgrade to a version where the Secure flag is properly set. The specific fixed version is not detailed in the provided reference, but IBM recommends applying the latest cumulative fix for GDE. No workaround is mentioned; upgrading is the recommended action.