Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T17:16:54.170Z",
  "pubdate": "2026-09-04T17:16:54.170Z",
  "executiveSummary": "A vulnerability classified as an XML External Entity (XXE) injection flaw has been identified in IBM App Connect Enterprise and IBM Integration Bus for z/OS. This security defect allows a remote, authenticated attacker to manipulate XML input to force the application to disclose sensitive local files or interact with internal network resources.\nThe vulnerability resides within the XML parsing logic of the affected products, specifically where external entities are processed without adequate validation or restriction. By submitting a crafted XML document containing a reference to an external entity, an attacker can bypass traditional security controls and access unauthorized data.\nAffected systems include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, versions 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. The impact includes the potential for information disclosure, which could lead to further system compromise or the exposure of configuration secrets and system-level credentials. Successful exploitation requires the attacker to be authenticated to the target system. Given the nature of XXE, the risk implications are significant, as the vulnerability potentially allows attackers to bypass file system access controls and facilitate server-side request forgery (SSRF) scenarios.",
  "technicalDetails": "The vulnerability stems from improper handling of XML documents during parsing operations within the affected IBM App Connect Enterprise and IBM Integration Bus for z/OS components. XML parsers that are not explicitly configured to disable the processing of Document Type Definitions (DTDs) or external entities are inherently susceptible to XXE injection attacks. In this case, the XML parser fails to sanitize input, allowing an attacker to inject a malicious DOCTYPE declaration into an XML message.\nThe attack flow begins when an authenticated attacker submits a specially crafted XML document to an endpoint that processes XML input. This document includes an ENTITY declaration that points to a sensitive local file path (e.g., 'file:///etc/passwd' or internal configuration files) or an external URI. When the XML parser processes the document, it interprets the external entity and attempts to resolve the URI or fetch the contents of the specified file. The parser then includes the retrieved data in the resulting output or response returned to the attacker.\nBecause the application performs the resolution of these entities, the attack is executed with the permissions of the application process itself, effectively bypassing local file system access restrictions. This allows the attacker to read files that the application has the authority to access, which often includes sensitive system configuration files, environment variables, or other proprietary application data.\nFurthermore, the vulnerability can be leveraged to conduct SSRF attacks. By pointing the external entity to an internal network address and port, the attacker can force the application server to make unauthorized requests to internal services that are not exposed to the public network. This could potentially allow for service discovery, interaction with internal APIs, or exploitation of other vulnerabilities in backend systems that trust the internal application server.\nAffected versions include IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. The exploitation process is highly reliable once authentication is achieved, as it relies on standard XML parsing behaviors. The impact is primarily information disclosure, but the ability to reach internal resources via SSRF significantly extends the threat surface, potentially enabling lateral movement or further exploitation within the secure enterprise environment."
}