CVE-2021-29838

Vulnerability

IBM Security Guardium Insights 3.0 fails to enable HTTP Strict Transport Security (HSTS), leaving the application vulnerable to protocol downgrade attacks. The missing HSTS header allows an attacker to intercept communications between the client and server using man-in-the-middle techniques [1].

Exploitation

An attacker positioned on the network between a user and the Guardium Insights server can perform a man-in-the-middle attack. By stripping the HTTPS connection or downgrading to HTTP, the attacker can eavesdrop on or modify transmitted data, potentially capturing sensitive information [1].

Impact

Successful exploitation leads to disclosure of sensitive information transmitted between the client and server. This could include credentials, configuration data, or other confidential material, compromising confidentiality and integrity of communications [1].

Mitigation

IBM has addressed this vulnerability in a security bulletin [1]. Users should apply the latest fix available from IBM. As a workaround, administrators can manually enforce HTTP Strict Transport Security by configuring the server to include the Strict-Transport-Security header [1].