IBM Security Guardium Data Encryption code execution

Vulnerability

IBM Guardium Cloud Key Manager (GCKM) 1.10.3 and lower, part of IBM Guardium Data Encryption, contains an angular template injection vulnerability [1]. A remote attacker can send specially crafted requests to trigger this flaw, leading to arbitrary code execution on the system. The CVSS base score is 6.5.

Exploitation

An attacker requires network access to the affected system and no authentication (PR:N). By sending a specially crafted request containing malicious template syntax, the attacker can inject and execute arbitrary code in the context of the application [1]. No user interaction is required.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the system, impacting integrity and availability (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). The attacker can perform unauthorized actions within the application's security context.

Mitigation

IBM has released a fix in a later version of Guardium Cloud Key Manager. Users should upgrade to the latest version (see IBM support page for details) [1]. No workarounds are documented. The vulnerability is not known to be in CISA's KEV as of publication.