CVE-2022-35282 Overview
CVE-2022-35282 is a server-side request forgery (SSRF) vulnerability affecting IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0. An attacker with adjacent network access can send a specially crafted request to coerce the server into making unintended outbound requests. Successful exploitation allows the attacker to obtain sensitive data accessible to the application server. The vulnerability is tracked under CWE-918 and was published to the National Vulnerability Database on September 28, 2022. IBM assigned internal identifier 230809 through its X-Force vulnerability database.
Critical Impact
An adjacent-network attacker can abuse WebSphere to issue server-side requests and exfiltrate sensitive data without authentication.
Affected Products
- IBM WebSphere Application Server 7.0
- IBM WebSphere Application Server 8.0 and 8.5
- IBM WebSphere Application Server 9.0
Discovery Timeline
- 2022-09-28 - CVE-2022-35282 published to NVD
- 2025-05-20 - Last updated in NVD database
Technical Details for CVE-2022-35282
Vulnerability Analysis
The flaw is a Server-Side Request Forgery (SSRF) issue in IBM WebSphere Application Server. The product fails to validate or restrict user-controllable input that influences the destination of a server-initiated request. An attacker positioned on the same logical network as the application server can submit a crafted request that forces WebSphere to issue outbound HTTP or other protocol requests to attacker-chosen destinations.
Because the vulnerable behavior runs from the trust context of the application server, the attacker can reach internal services, metadata endpoints, and management interfaces that are otherwise unreachable from external networks. The confidentiality impact is high while integrity and availability are not affected, consistent with an information-disclosure-oriented SSRF.
The vulnerability does not require authentication or user interaction, but exploitation requires adjacent network access rather than direct internet reachability. This limits the exposed attack surface to peers within the same broadcast domain, VPN, or routed enclave as the WebSphere instance.
Root Cause
The root cause is insufficient validation of a request parameter that the server uses to construct an outbound request URL. WebSphere processes the supplied value as a destination without applying an allowlist of permitted hosts, schemes, or internal address ranges. This classification matches CWE-918: Server-Side Request Forgery.
Attack Vector
An attacker with adjacent network access sends a crafted HTTP request to a vulnerable WebSphere endpoint. The request includes a parameter or header value that influences the URL WebSphere fetches server-side. WebSphere then connects to the attacker-specified target, including loopback addresses, internal subnets, and cloud metadata services. The response or response metadata returned to the attacker can disclose internal data, configuration details, or credentials retrievable through accessible endpoints.
No verified public proof-of-concept code or exploit is available for this CVE. Refer to the IBM Support Advisory 6824179 for vendor-supplied technical details.
Detection Methods for CVE-2022-35282
Indicators of Compromise
- Outbound HTTP connections from WebSphere JVMs to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
- Unexpected entries in WebSphere SystemOut.log showing outbound requests initiated by application threads to non-business destinations.
- Spikes in DNS resolution requests from WebSphere hosts for unfamiliar or attacker-controlled domains.
Detection Strategies
- Inspect WebSphere HTTP access logs for parameters containing URLs, IP literals, or schemes such as file://, gopher://, or dict://.
- Correlate inbound HTTP requests to WebSphere with simultaneous outbound network connections from the same JVM process.
- Apply network monitoring rules that flag application-server hosts connecting to metadata service IP ranges or non-approved internal services.
Monitoring Recommendations
- Enable verbose HTTP request logging on WebSphere and forward logs to a centralized analytics platform for review.
- Baseline egress traffic from WebSphere nodes and alert on deviations to new internal hosts or external destinations.
- Monitor authentication and access logs on internal services that WebSphere can reach, looking for unexpected requests originating from application-server IP addresses.
How to Mitigate CVE-2022-35282
Immediate Actions Required
- Apply the interim fix or cumulative fix referenced in the IBM Support Advisory 6824179 for the affected WebSphere version.
- Restrict network reachability of WebSphere administrative and application endpoints to trusted management subnets only.
- Enforce egress filtering on WebSphere hosts to block outbound connections to metadata endpoints and unapproved internal services.
Patch Information
IBM has published remediation guidance and fixes through the IBM Support Advisory 6824179 and tracks the issue as IBM X-Force Vulnerability #230809. Administrators must apply the appropriate fix pack or interim fix corresponding to their installed version (7.0, 8.0, 8.5, or 9.0).
Workarounds
- Place WebSphere instances behind a forward proxy that enforces an allowlist of permitted outbound destinations.
- Segment WebSphere hosts so that they cannot reach sensitive internal services, cloud metadata endpoints, or management planes.
- Restrict adjacent network access to WebSphere by limiting layer-2 and VLAN exposure to authenticated administrative systems.
# Example egress restriction using iptables on a WebSphere host
# Block access to cloud metadata service
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
# Allow only approved internal destinations
iptables -A OUTPUT -p tcp -d 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d 0.0.0.0/0 --dport 443 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
