Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-14T20:16:40.663Z",
  "pubdate": "2026-09-14T20:16:40.663Z",
  "executiveSummary": "A critical XML External Entity (XXE) injection vulnerability exists within the IBM DataStage PxXMLInput operator in IBM DataStage on Cloud Pak for Data 5.4.0.0.\nThis vulnerability allows a remote authenticated attacker to manipulate XML input to force the application to process unauthorized external entities.\nSuccessful exploitation enables the attacker to perform Server-Side Request Forgery (SSRF) attacks or disclose sensitive local files stored on the underlying file system of the DataStage server.\nThe vulnerability resides in the way the PxXMLInput operator parses XML data, potentially leading to the exposure of configuration files, internal network artifacts, or authentication tokens.\nTo exploit this, an attacker must have authenticated access to the platform and the ability to provide specially crafted XML input to the PxXMLInput operator.\nThe impact is significant, potentially compromising the confidentiality of the data processing environment and internal infrastructure connectivity.",
  "technicalDetails": "The vulnerability originates from the insecure configuration or implementation of the XML parser within the IBM DataStage PxXMLInput operator. Specifically, the parser fails to properly disable the resolution of external entities when processing user-supplied XML documents.\nWhen the PxXMLInput operator receives XML content, it parses the document according to the W3C XML standard. If the parser is not configured to restrict Document Type Definition (DTD) processing or external entity resolution, an attacker can define custom entities pointing to local system resources (via file:// URIs) or external network services (via http:// or https:// URIs).\nThe attack flow begins with the attacker constructing a malicious XML payload. This payload includes a DOCTYPE declaration defining an external entity that references an sensitive file, such as /etc/passwd, or an internal service URL. Upon submission, the PxXMLInput operator attempts to resolve these entities during the parsing phase. The XML parser then fetches the content from the specified URI and includes it within the resulting output or triggers a connection from the server to the target URI.\nBecause the PxXMLInput operator is a core component of DataStage data integration workflows, an authenticated attacker can inject these malicious XML structures into jobs or configurations that are subsequently executed by the operator. The operator executes with the privileges of the service user, meaning the attacker effectively gains the ability to read any file readable by that user account on the host system.\nFurthermore, this behavior facilitates SSRF, allowing the attacker to scan internal network segments, interact with cloud metadata services (if hosted in a cloud environment), or probe local services that are not exposed to the public network. Since the vulnerability is limited to authenticated users, the primary constraint is the attacker's ability to interface with the PxXMLInput operator, which is a standard capability within the authorized scope of a DataStage designer or administrator."
}