Description

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T20:16:38.663Z",
  "pubdate": "2026-09-14T20:16:38.663Z",
  "executiveSummary": "A blind Server-Side Request Forgery (SSRF) vulnerability exists in IBM WebSphere Application Server versions 9.0 and 8.5.\nThis vulnerability originates from improper handling of SOAP requests, allowing a remote, unauthenticated attacker to force the application to initiate unauthorized HTTP requests to arbitrary targets.\nBy leveraging this flaw, an attacker can conduct reconnaissance on internal network segments, interact with internal services that are otherwise shielded by firewalls, and potentially exfiltrate sensitive metadata or service responses.\nThe risk is significant as it bypasses traditional perimeter defenses and internal network access controls. Exploitation does not require prior authentication, making it a critical threat to internal infrastructure integrity and confidentiality.\nThe primary impact involves unauthorized service discovery, potential information leakage from internal APIs, and the possibility of chaining the SSRF with other vulnerabilities to achieve further internal compromise.",
  "technicalDetails": "The vulnerability resides within the SOAP processing engine of IBM WebSphere Application Server 9.0 and 8.5. The root cause is the insufficient validation of URIs provided within the SOAP envelope, specifically when the application performs lookups or processes remote resources via the SOAP protocol.\nDuring the processing of a maliciously crafted SOAP request, the server fails to adequately sanitize or restrict the destination host and port information. When the vulnerable component attempts to resolve or fetch resources associated with the user-provided SOAP request, it inadvertently follows the attacker-supplied URI.\nThe attack flow begins when an attacker sends a specially crafted SOAP message to the WebSphere endpoint. The request includes parameters that direct the application to connect to a target system chosen by the attacker. Because the vulnerability is 'blind,' the attacker may not receive the direct response content of the resource being queried; however, they can infer the success or failure of the connection based on response timing or side-channel data.\nExploitation allows the attacker to interact with the backend infrastructure, effectively positioning the application server as a proxy or agent. This is particularly dangerous in cloud or containerized environments where internal metadata services (e.g., AWS/GCP instance metadata endpoints) or internal management consoles reside.\nThe vulnerable component is the SOAP transport or processing layer responsible for handling incoming service requests. The exploitation is network-exposed, requiring only connectivity to the application's SOAP service endpoint. No authentication is necessary to trigger the SSRF condition, as the vulnerability occurs during the initial request parsing phase before session validation is enforced.\nPost-exploitation impact includes the ability to map internal network topology, identify active services, perform port scanning on private subnets, and potentially exploit secondary services that trust the application server's origin. By manipulating the request parameters, an attacker can coerce the server to interact with non-HTTP services, which may lead to further exploitation depending on the specific backend service response patterns and handling."
}