Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-07T05:18:42.120Z",
  "pubdate": "2026-11-07T05:18:42.120Z",
  "executiveSummary": "IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an XML External Entity (XXE) injection vulnerability. This flaw arises from the improper processing of XML input containing external entity references by the underlying XML parser. An unauthenticated remote attacker can exploit this vulnerability by submitting specially crafted XML documents to the affected API Connect endpoints. Successful exploitation allows the attacker to disclose sensitive information stored on the server, including local files, configuration details, or internal network resources. The impact involves potential confidentiality breaches and unauthorized data access. The vulnerability requires no prior authentication, significantly increasing the risk profile for exposed instances. Remediation involves ensuring that XML parsers used by the application are configured to disable Document Type Definition (DTD) processing and external entity resolution.",
  "technicalDetails": "The vulnerability originates from a failure in the XML parsing logic within IBM API Connect to sanitize or restrict input containing DTDs. When the XML parser is configured to resolve external entities, it processes defined entities in the DOCTYPE header of an XML document. An attacker can leverage this functionality to perform an XXE injection, where a malicious XML payload instructs the parser to fetch content from a URI specified by the attacker.\nThe attack flow begins when an attacker sends a crafted XML request to an endpoint handled by the vulnerable component. The payload typically includes a <!DOCTYPE> element defining an external entity that points to a sensitive file on the server's filesystem (e.g., /etc/passwd or application configuration files) or an internal network resource accessible to the server. For example, a payload might look like: <!DOCTYPE root [ <!ENTITY xxe SYSTEM 'file:///etc/passwd'> ]> <root>&xxe;</root>.\nUpon receiving the request, the XML parser interprets the entity definition. If external entity resolution is enabled and not properly restricted, the parser attempts to resolve the entity by reading the target resource. The content of the target file is then returned as part of the XML response or processed by the application, effectively exposing sensitive information to the attacker. This process bypasses standard access controls because the parsing engine acts with the privileges of the API Connect service process.\nThis vulnerability is present in versions 12.1.0.0 through 12.1.1.2. The exposure is primarily network-based, as the attacker must be able to reach the vulnerable API endpoint via the network. Because the vulnerability allows for arbitrary file reading based on the application's process permissions, it can lead to credential theft, exposure of sensitive configuration parameters (such as database credentials or API keys), and further reconnaissance of the internal infrastructure. Post-exploitation impact is limited only by the permissions of the service account under which the IBM API Connect component is running, which may lead to lateral movement if secrets are harvested from the local system."
}