Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T20:16:42.930Z",
  "pubdate": "2026-09-14T20:16:42.930Z",
  "executiveSummary": "This vulnerability involves an improper validation of the WebSocket origin within IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw resides in the handling of WebSocket handshake requests, where the server fails to verify the integrity and legitimacy of the origin header provided by the client.\nA remote, unauthenticated attacker can exploit this weakness to bypass security constraints, potentially leading to unauthorized information disclosure. By crafting malicious requests, an attacker can coerce the application into accepting WebSocket connections from unauthorized sources.\nThe vulnerability poses a significant risk to the confidentiality of sensitive system information stored within the IBM i environment. Because WebSocket connections allow for bidirectional, real-time communication, the lack of origin validation effectively undermines the Cross-Site WebSocket Hijacking (CSWSH) protections that should be enforced at the protocol level.\nThe primary impact is the unauthorized exposure of sensitive data transmitted over the hijacked WebSocket connection. Exploitation does not necessarily require local access or high-level privileges; it relies on the attacker's ability to trigger a connection request from a user's browser, making the system susceptible to client-side attacks directed against the server infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of origin checking during the WebSocket opening handshake process in IBM i. According to RFC 6455, a server should verify the 'Origin' header provided by the client during the handshake to ensure the connection request is originating from a trusted or expected domain.\nIn the affected versions (IBM i 7.3, 7.4, 7.5, and 7.6), the system fails to perform this verification strictly. When a client initiates a WebSocket connection request via the HTTP/HTTPS upgrade mechanism, the IBM i server neglects to validate that the request originated from an authorized source.\nThe attack flow proceeds as follows: An attacker hosts a malicious script on a third-party website. A victim, who is currently authenticated to the IBM i web interface, visits the attacker's malicious site. The script executes and attempts to open a WebSocket connection to the vulnerable IBM i server. Because the server fails to validate the 'Origin' header, it treats the incoming connection as legitimate. Once the handshake is successfully completed, the malicious script can interact with the IBM i WebSocket service, sending and receiving data as if it were the authenticated victim. This allows the attacker to steal sensitive information transmitted over the channel or execute commands allowed by the current user's security context.\nThis vulnerability is categorized as a failure in proper input/header validation, specifically related to the security mechanisms defined for WebSocket protocol interaction. Because the vulnerability pertains to the WebSocket handshake phase, it occurs over the network layer where the service is exposed. There is no requirement for the attacker to have pre-existing privileges on the system, as the attack leverages the existing session of an authenticated user to achieve unauthorized data access.\nPost-exploitation, the impact can extend to the extraction of sensitive data exposed through the WebSocket API. If the affected WebSocket service facilitates management or administrative functions, the attacker could theoretically perform actions with the victim's privileges. The exposure is limited to the functionality provided by the specific WebSocket endpoint that lacks the origin verification controls."
}