Description

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T22:16:56.470Z",
  "pubdate": "2026-09-14T22:16:56.470Z",
  "executiveSummary": "IBM Business Automation Workflow (BAW), in both containerized and traditional deployment architectures, is susceptible to an XML External Entity (XXE) injection vulnerability. This flaw arises from the improper processing of XML input, allowing an unauthenticated remote attacker to manipulate the XML parser's configuration.\nBy submitting maliciously crafted XML data containing external entity references, an attacker can coerce the application into processing unauthorized URI references. The potential impact of this vulnerability is significant, as it facilitates the disclosure of sensitive internal system information, such as configuration files, local file contents, or internal network metadata. Furthermore, the vulnerability can be leveraged to conduct resource exhaustion attacks, specifically memory exhaustion, which may lead to a denial-of-service (DoS) condition affecting the availability of the workflow management platform.\nThe risk is elevated due to the nature of IBM BAW as a core enterprise automation component, often positioned within sensitive internal networks. Successful exploitation does not inherently require high-level privileges, provided the attacker has network access to the endpoints responsible for parsing XML data. Organizations should prioritize identifying affected instances and applying recommended vendor-provided patches or configuration changes to disable external entity resolution within XML parsers.",
  "technicalDetails": "The vulnerability resides in the XML parsing components utilized by IBM Business Automation Workflow during the intake and processing of XML-based data structures. An XXE vulnerability occurs when an XML parser is configured to process Document Type Definitions (DTDs) and permit the resolution of external entities without sufficient validation or security controls.\nThe root cause is the failure to disable the loading of external entities and external parameter entities in the underlying XML processing libraries (e.g., JAXP, Xerces). When a parser is left in its default configuration, it may resolve URI references defined within the 'ENTITY' tag of an XML document. An attacker can craft a payload that includes an 'DOCTYPE' declaration referencing a local system file or an internal service URL via various protocols such as 'file://', 'http://', or 'ftp://'.\nThe attack flow typically follows these steps: 1) The attacker identifies an input vector where the application accepts XML-formatted requests, such as REST APIs, SOAP services, or document ingestion endpoints. 2) The attacker crafts a malicious XML payload. To perform information disclosure, the payload defines an entity referencing a sensitive file path (e.g., 'file:///etc/passwd' or internal configuration files). 3) The payload is transmitted to the vulnerable IBM BAW endpoint. 4) The server-side XML parser processes the DTD and attempts to expand the external entity. 5) The content of the targeted file is substituted into the XML document, which may then be reflected in the application's response, or used in subsequent processing logic that exposes the data.\nIn scenarios where memory exhaustion is the objective, attackers may employ 'XML bombs' or 'Billion Laughs' attacks, which involve nested entity definitions that expand exponentially when parsed. This results in the allocation of excessive memory by the JVM running the BAW process, leading to a crash or severe performance degradation of the application server. The vulnerability is present in both traditional WebSphere-based deployments and containerized environments. Exploitation is generally performed remotely over the network, and the efficacy of the attack is dependent on the permissions of the service account under which the IBM BAW process is running. If the application environment lacks strict egress filtering or file system access controls, the impact is exacerbated, potentially allowing for internal network reconnaissance via Server-Side Request Forgery (SSRF) as a secondary effect of the XXE primitive."
}