Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T17:16:54.337Z",
  "pubdate": "2026-09-04T17:16:54.337Z",
  "executiveSummary": "A vulnerability classified as XML External Entity (XXE) injection exists within IBM App Connect Enterprise and IBM Integration Bus for z/OS.\nThe flaw allows a remote authenticated attacker to influence XML parsing processes to disclose sensitive information from the host system.\nAffected products include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7.\nThis vulnerability stems from improper input validation of XML documents during parsing, where the parser is configured to process externally defined entities.\nAn attacker possessing valid authentication credentials can leverage this defect to bypass security controls and exfiltrate internal data, such as local configuration files, system credentials, or network-accessible resources.\nThe risk is significant as it provides a mechanism for unauthorized data discovery and potential reconnaissance for further exploitation within the application environment.\nExploitation requires the attacker to be authenticated, limiting the attack surface to authorized users or compromised accounts.",
  "technicalDetails": "The vulnerability resides in the XML parsing engine utilized by IBM App Connect Enterprise and IBM Integration Bus for z/OS.\nThe root cause is the insecure configuration of the XML parser, which does not sufficiently disable the resolution of external entities when processing user-supplied XML payloads.\nIn an XML document, a Document Type Definition (DTD) can define an external entity using the 'SYSTEM' or 'PUBLIC' identifier. When the XML parser is improperly configured, it attempts to resolve these entities by fetching the content of the specified URI or file path.\nThe attack flow begins with an authenticated attacker submitting a malicious XML document containing an external entity definition to an endpoint that parses the input.\nThe entity definition points to a sensitive file on the server's filesystem, such as '/etc/passwd' or internal configuration files containing encryption keys or service credentials.\nUpon receiving the request, the underlying XML parser processes the DTD and attempts to expand the entity by accessing the target resource.\nBecause the parser does not restrict access to local system resources, it reads the content of the referenced file and substitutes the entity reference with the file's contents within the resulting output.\nThe attacker then retrieves this sensitive information through the application's response, which may include the contents of the target files within an error message or a legitimate application response field.\nThis vulnerability is classified as an XXE injection. The exploit is facilitated by the parser's support for DTDs and the lack of robust input sanitization or restrictive parser configuration, such as disabling DTD processing or external entity resolution.\nSince the attack requires authentication, the scope is limited to users with sufficient privileges to interact with XML-processing components. However, this does not mitigate the risk posed by malicious insiders or compromised service accounts.\nPost-exploitation impact includes unauthorized exposure of sensitive system data, potential credential theft, and information disclosure that facilitates subsequent attacks, such as lateral movement or privilege escalation within the integrated environment.\nAffected versions include IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7."
}