IBM Maximo Application Suite 信息泄露

攻击者可以利用此漏洞发送精心构造的 URL 请求，其中包含“点点”序列（/../），从而绕过访问控制机制。这使得攻击者能够访问系统上的任意文件，包括包含敏感信息的文件，例如配置文件、数据库凭据或源代码。潜在的数据泄露风险很高，可能导致严重的业务中断和声誉损害。此漏洞的范围取决于系统配置和可访问的文件数量，可能影响整个 Maximo Application Suite 环境。

Organizations deploying IBM Maximo Application Suite versions 8.10 and 8.11 are at risk. This includes companies utilizing Maximo for asset management, predictive maintenance, and other enterprise work management applications. Shared hosting environments where multiple tenants share the same server instance are particularly vulnerable, as a successful attack could potentially impact other tenants.

• linux / server: Monitor access logs for requests containing /../ sequences. Use grep to search for these patterns in web server access logs (e.g., /var/log/apache2/access.log).

grep '/\.\./' /var/log/apache2/access.log

• generic web: Use curl to test for directory traversal vulnerabilities. Attempt to access files outside of the intended web root.

curl http://<maximo_suite_url>/../../../../etc/passwd

• other: Review file system permissions to ensure that sensitive files are not accessible from the web server's document root.

1. 2024-04-06Disclosure

   disclosure

1. 已保留2024-01-08
2. 发布日期2024-04-06
3. 修改日期2024-08-01
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 Maximo Application Suite 升级至 8.10.1 或更高版本。如果无法立即升级，可以考虑实施临时缓解措施，例如限制对 Maximo Application Suite 服务器的访问，并审查和强化文件权限。此外，应部署 Web 应用防火墙 (WAF) 以检测和阻止目录遍历攻击。监控 Maximo Application Suite 日志，寻找异常的 URL 请求和文件访问尝试，有助于及早发现潜在的攻击。