Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-04T15:17:35.550Z",
  "pubdate": "2026-09-04T15:17:35.550Z",
  "executiveSummary": "The SAP Adapter component within multiple versions of IBM App Connect Enterprise and IBM Integration Bus for z/OS is susceptible to an XML External Entity (XXE) injection vulnerability.\nThis vulnerability arises due to improper parsing of XML input, allowing an unauthenticated remote attacker to coerce the application into processing specially crafted XML documents containing malicious external entity references.\nSuccessful exploitation permits unauthorized access to sensitive internal files, internal network resources, or the potential for server-side request forgery (SSRF).\nAffected products include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.\nThe risk implication is critical, as it bypasses standard security controls to expose proprietary data or backend systems accessible via the integration node. Attackers do not necessarily require prior authentication, though the specific entry point must be reachable by the attacker.",
  "technicalDetails": "The vulnerability originates from the XML parser configuration within the SAP Adapter component, which fails to securely disable the processing of external entities when parsing user-supplied XML data.\nAn XXE vulnerability occurs when an XML parser, configured to resolve external entities defined within the DOCTYPE declaration of an XML document, attempts to fetch these entities from remote or local resources.\nThe attack flow begins when an attacker transmits a maliciously crafted XML payload to the SAP Adapter integration endpoint. This payload includes an ENTITY definition that references a sensitive local file path (e.g., file:///etc/passwd) or a URI pointing to an internal network resource.\nUpon receiving the input, the underlying XML parser processes the document. Because the parser is not explicitly restricted from expanding external entities, it retrieves the contents of the defined resource and potentially returns the data within the application response or logs.\nAlternatively, if the payload is designed to point to internal IP addresses or services, the SAP Adapter component may act as an intermediary, facilitating Server-Side Request Forgery (SSRF) to probe internal network services that are otherwise protected by firewalls.\nThe impact of this exploitation is multi-fold: 1) Confidentiality Loss: The attacker can exfiltrate sensitive local files accessible to the user account running the integration node. 2) Network Discovery: The attacker can map internal network topologies by observing responses from internal URLs. 3) Denial of Service: By referencing 'billion laughs' style entity expansions, an attacker may induce resource exhaustion leading to service instability.\nThis vulnerability is rooted in the implementation of the XML document processing logic within the SAP Adapter. The lack of proper validation or the use of default parser settings that enable DTD (Document Type Definition) processing is the primary cause.\nNo specific privileges are required if the SAP Adapter interface is exposed to the network, and the attack does not require specialized knowledge of the internal infrastructure, only the capability to send XML-based requests to the vulnerable SAP Adapter endpoint."
}