IBM FTM Open Redirect in RedHat OpenShift

Executive Summary

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has an open redirect vulnerability in the PMP HostHeaderFilter. An unauthenticated attacker can manipulate the Host header in a request to redirect authenticated operators to malicious sites, potentially stealing credentials through phishing.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring HTTP requests for manipulated Host headers in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. Check logs for requests where the Host header does not match the expected domain. Use network monitoring tools like tcpdump or Wireshark to capture and inspect HTTP traffic for suspicious Host header values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to trick authenticated users into visiting attacker-controlled websites, which could lead to credential theft or further exploitation of user sessions. It primarily affects operators managing IBM FTM on RedHat OpenShift.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling credential phishing attacks. If attackers gain credentials through phishing, they may access sensitive financial or personal data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest IBM Financial Transaction Manager patch for the PMP HostHeaderFilter. Review and update network traffic filters to block suspicious Host header values. Monitor HTTP 3xx redirects from authenticated sessions to external domains.

Useful 0 Not Useful 0