Login Sign Up

CVE-2021-38951

7.5 HIGH
Denial of Service

📋 TL;DR

This vulnerability in IBM WebSphere Application Server allows remote attackers to cause a denial of service by sending specially crafted requests that consume all available CPU resources. Affected versions include WebSphere 7.0, 8.0, 8.5, and 9.0, potentially impacting any organization running these versions without proper patching.

💻 Affected Systems

Products:
  • IBM WebSphere Application Server
Versions: 7.0, 8.0, 8.5, 9.0
Operating Systems: All supported platforms (Windows, Linux, AIX, etc.)
Default Config Vulnerable: ⚠️ Yes
Notes: All configurations of affected versions are vulnerable. The vulnerability exists in the core WebSphere components.

📦 What is this software?

Websphere Application Server by Ibm

View all CVEs affecting Websphere Application Server →

Websphere Application Server by Ibm

View all CVEs affecting Websphere Application Server →

Websphere Application Server by Ibm

View all CVEs affecting Websphere Application Server →

Websphere Application Server by Ibm

View all CVEs affecting Websphere Application Server →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service outage as the server becomes unresponsive due to 100% CPU utilization, affecting all applications hosted on the vulnerable WebSphere instance.

🟠

Likely Case

Degraded performance and intermittent service disruptions as CPU resources are exhausted, potentially leading to application timeouts and user impact.

🟢

If Mitigated

Minimal impact with proper network segmentation, rate limiting, and monitoring in place to detect and block malicious traffic patterns.

🌐 Internet-Facing: HIGH - Remote attackers can exploit this without authentication, making internet-facing instances particularly vulnerable to DoS attacks.
🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could still exploit this, but requires network access to the WebSphere server.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability requires sending specially crafted requests but does not require authentication. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply the latest cumulative fix or interim fix for your version as specified in IBM advisory

Vendor Advisory: https://www.ibm.com/support/pages/node/6524674

Restart Required: Yes

Instructions:

1. Review IBM advisory for specific fix details. 2. Download appropriate fix from IBM Fix Central. 3. Apply fix following IBM installation procedures. 4. Restart WebSphere Application Server.

🔧 Temporary Workarounds

Network Filtering

all

Implement network-level filtering to block suspicious request patterns

Rate Limiting

all

Configure WebSphere or network devices to limit request rates from single sources

🧯 If You Can't Patch

  • Implement strict network segmentation to isolate WebSphere servers from untrusted networks
  • Deploy Web Application Firewall (WAF) with DoS protection rules and monitor for abnormal request patterns

🔍 How to Verify

Check if Vulnerable:

Check WebSphere version via Admin Console or using versionInfo.sh/.bat script. Compare against affected versions list.

Check Version:

cd $WAS_HOME/bin && ./versionInfo.sh (Linux) or versionInfo.bat (Windows)

Verify Fix Applied:

Verify fix installation through IBM Installation Manager or by checking fix levels in WebSphere logs/console.

📡 Detection & Monitoring

Log Indicators:

  • Sustained high CPU usage alerts
  • Unusual request patterns in access logs
  • System log entries showing resource exhaustion

Network Indicators:

  • Abnormal traffic spikes to WebSphere ports
  • Repeated similar request patterns from single sources

SIEM Query:

source="websphere" AND (cpu_usage>90 OR error="resource" OR pattern="DoS")

📊 Metadata

CVE ID: CVE-2021-38951
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: December 9, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON