CVE-2024-45072
📋 TL;DR
IBM WebSphere Application Server 8.5 and 9.0 contains an XML External Entity (XXE) vulnerability that allows privileged users to read arbitrary files from the server or cause denial of service through resource exhaustion. This affects administrators and users with elevated privileges who can submit XML data to vulnerable endpoints.
💻 Affected Systems
- IBM WebSphere Application Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker reads sensitive files (passwords, configuration files, system files) and causes memory exhaustion leading to denial of service.
Likely Case
Privileged user accidentally or intentionally reads internal files, potentially exposing sensitive configuration data.
If Mitigated
Limited impact due to privilege requirements and proper XML parsing configuration.
🎯 Exploit Status
Requires privileged access and knowledge of vulnerable XML endpoints. XXE exploitation is well-documented in security community.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Interim Fix PI99870 for 8.5 and PI99871 for 9.0
Vendor Advisory: https://www.ibm.com/support/pages/node/7173263
Restart Required: Yes
Instructions:
1. Download appropriate interim fix from IBM Fix Central. 2. Stop WebSphere Application Server. 3. Apply the fix using IBM Installation Manager. 4. Restart WebSphere Application Server. 5. Verify fix application.
🔧 Temporary Workarounds
Disable XXE Processing
allConfigure XML parsers to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, DISALLOW_DOCTYPE_DECL=true
Input Validation
allImplement XML schema validation and sanitize XML inputs
🧯 If You Can't Patch
- Restrict privileged user access to XML processing endpoints
- Implement network segmentation and monitor for unusual XML payloads
🔍 How to Verify
Check if Vulnerable:
Check WebSphere version and if interim fixes PI99870 (8.5) or PI99871 (9.0) are appliedCheck Version:
$WAS_HOME/bin/versionInfo.sh (Linux) or versionInfo.bat (Windows)Verify Fix Applied:
Verify interim fix installation via Installation Manager and test XXE payloads📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- File access attempts via XML entities
- Memory exhaustion warnings
Network Indicators:
- Large XML payloads with external entity references
- Unusual requests to XML processing endpoints
SIEM Query:
source="websphere" AND (message="*XXE*" OR message="*external entity*" OR message="*DOCTYPE*")