CVE-2024-27455 in Assetwise ALIM Web
Summary
by MITRE • 02/26/2024
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/15/2026
The vulnerability identified as CVE-2024-27455 affects the Bentley ALIM Web application where specific configuration settings create a security flaw leading to unauthorized exposure of user session tokens during file download operations. This represents a critical weakness in the application's session management and access control mechanisms, potentially allowing attackers to hijack user sessions and gain unauthorized access to sensitive data and functionalities within the ALIM environment. The issue manifests specifically when users attempt to download files, indicating that the vulnerability is tied to the file transfer process rather than general application usage.
The technical root cause of this vulnerability lies in improper handling of session tokens within the ALIM Web application's download functionality. When users initiate file downloads, the system inadvertently exposes session tokens through HTTP headers, URL parameters, or response content, creating an attack surface that can be exploited by malicious actors. This flaw aligns with CWE-200, which addresses exposure of sensitive information, and specifically relates to improper session token management during file transfer operations. The vulnerability demonstrates a failure in implementing proper access control and session isolation mechanisms, allowing session data to leak during legitimate user operations.
The operational impact of CVE-2024-27455 extends beyond simple credential exposure, as compromised session tokens can enable attackers to perform unauthorized actions within the ALIM system. This includes accessing restricted files, modifying configurations, executing administrative functions, and potentially escalating privileges within the application environment. The vulnerability creates a persistent risk for organizations relying on ALIM Web for asset management and information integrity, as session hijacking attacks can remain undetected for extended periods. According to ATT&CK framework, this vulnerability maps to T1566 (Phishing) and T1531 (Account Access Removal) through session token compromise, and potentially T1071 (Application Layer Protocol) when attackers use the exposed tokens to communicate with the application.
Organizations utilizing Bentley ALIM Web applications must implement immediate mitigations including upgrading to the fixed versions Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03 as recommended by the vendor. Additionally, administrators should review and audit current configuration settings to identify any instances where the vulnerable parameters might be enabled. Security teams should implement network monitoring to detect potential exploitation attempts and consider implementing additional access controls such as token rotation mechanisms and enhanced logging of file download activities. The vulnerability also underscores the importance of proper input validation and output encoding in web applications, particularly when handling session data during file transfer operations. Organizations should conduct comprehensive security assessments of their ALIM deployments to ensure no other similar vulnerabilities exist in related components or integrated systems.