CVE-2022-35282: IBM WebSphere Application Server SSRF

CVE-2022-35282 Overview

IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 contain a Server-Side Request Forgery (SSRF) vulnerability that allows attackers with local network access to obtain sensitive data by sending specially crafted requests. This vulnerability enables unauthorized access to internal resources and potentially exposes confidential information from backend systems that would otherwise be inaccessible from external networks.

Critical Impact

Attackers with adjacent network access can exploit SSRF to access internal services, retrieve sensitive configuration data, and potentially pivot to other internal systems that trust the WebSphere server.

Affected Products

• IBM WebSphere Application Server 7.0
• IBM WebSphere Application Server 8.0
• IBM WebSphere Application Server 8.5
• IBM WebSphere Application Server 9.0

Discovery Timeline

• September 28, 2022 - CVE-2022-35282 published to NVD
• May 20, 2025 - Last updated in NVD database

Technical Details for CVE-2022-35282

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in IBM WebSphere Application Server allows an attacker positioned on the adjacent network to manipulate server-side requests. The vulnerability stems from insufficient validation of user-supplied input that controls URL destinations or request parameters within the application server's request handling mechanisms.

When exploited, the WebSphere server can be coerced into making requests to arbitrary internal or external destinations on behalf of the attacker. This is particularly dangerous in enterprise environments where WebSphere servers often have trusted access to internal services, databases, and management interfaces that are not directly accessible from external networks.

The attack requires adjacent network positioning (such as being on the same local network segment), but does not require authentication or user interaction, making it exploitable by any attacker who has gained access to the internal network.

Root Cause

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), indicating that the WebSphere Application Server fails to properly validate or sanitize URLs or request destinations before the server processes outbound requests. This allows attackers to specify arbitrary endpoints, causing the server to make requests to unintended destinations. The lack of proper URL allowlisting or input sanitization enables the SSRF attack vector.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be positioned on the same local network segment as the vulnerable WebSphere server. From this position, the attacker sends specially crafted requests that manipulate the server into making requests to internal resources. The attack does not require authentication or user interaction.

The exploitation flow typically involves:

1. Attacker gains access to the adjacent network where WebSphere is deployed
2. Attacker identifies the vulnerable WebSphere server endpoint
3. Attacker crafts a malicious request containing internal target URLs
4. WebSphere processes the request and makes a server-side request to the attacker-specified destination
5. Attacker receives sensitive data from internal resources through the response

For technical implementation details, refer to the IBM Support Article on Security.

Detection Methods for CVE-2022-35282

Indicators of Compromise

• Unusual outbound requests from WebSphere servers to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or localhost addresses
• HTTP requests containing internal hostnames or IP addresses in URL parameters or request bodies
• Server logs showing requests to metadata endpoints (e.g., cloud provider metadata services at 169.254.169.254)
• Unexpected access patterns to internal services from WebSphere server IPs

Detection Strategies

• Monitor WebSphere access logs for requests containing internal IP addresses or hostnames in query parameters
• Implement network monitoring to detect anomalous outbound connections from WebSphere servers to internal resources
• Deploy web application firewalls (WAF) with SSRF detection rules to identify and block malicious request patterns
• Configure SIEM rules to alert on WebSphere servers accessing unusual internal endpoints

Monitoring Recommendations

• Enable verbose logging on WebSphere Application Server to capture full request details including URL parameters
• Implement egress filtering and monitoring on network segments containing WebSphere servers
• Deploy SentinelOne agents on WebSphere hosts to monitor for suspicious network activity and process behavior
• Establish baseline network communication patterns for WebSphere servers and alert on deviations

How to Mitigate CVE-2022-35282

Immediate Actions Required

• Review and apply the security patches from IBM for affected WebSphere Application Server versions (7.0, 8.0, 8.5, 9.0)
• Implement network segmentation to limit adjacent network access to WebSphere servers
• Deploy WAF rules to filter requests containing internal IP addresses or suspicious URL patterns
• Audit WebSphere configurations for any features that process user-controlled URLs

Patch Information

IBM has released security patches addressing this vulnerability. Organizations should consult the IBM Support Article on Security for specific patch information and apply the appropriate fix pack or interim fix for their WebSphere version. Additional technical details are available through the IBM X-Force Vulnerability #230809.

Workarounds

• Implement strict input validation and URL allowlisting for any WebSphere components that process external URLs
• Configure network-level egress controls to restrict WebSphere servers from accessing sensitive internal resources
• Deploy reverse proxy or WAF in front of WebSphere to inspect and filter potentially malicious requests
• Disable or restrict access to any WebSphere features or endpoints that accept user-controlled URL inputs

# Network segmentation example - restrict WebSphere server outbound access
# Add iptables rules to limit SSRF impact (Linux hosts)
iptables -A OUTPUT -m owner --uid-owner websphere -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner websphere -d 10.0.0.0/8 -p tcp --dport 80 -j LOG --log-prefix "WAS_SSRF_ATTEMPT: "
iptables -A OUTPUT -m owner --uid-owner websphere -d 172.16.0.0/12 -p tcp --dport 80 -j LOG --log-prefix "WAS_SSRF_ATTEMPT: "