CVE-2024-22354: IBM WebSphere Application Server XXE Vulnerability

CVE-2024-22354 Overview

IBM WebSphere Application Server versions 8.5, 9.0 and IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. This vulnerability allows a remote attacker to exploit improper XML parsing to expose sensitive information, consume memory resources, or conduct server-side request forgery (SSRF) attacks.

Critical Impact

Remote attackers can exploit this XXE vulnerability to access sensitive server-side files, enumerate internal network resources via SSRF, or cause denial of service through memory exhaustion.

Affected Products

• IBM WebSphere Application Server 8.5 (Traditional)
• IBM WebSphere Application Server 9.0 (Traditional)
• IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5

Discovery Timeline

• 2024-04-17 - CVE-2024-22354 published to NVD
• 2025-03-06 - Last updated in NVD database

Technical Details for CVE-2024-22354

Vulnerability Analysis

This XML External Entity Injection (XXE) vulnerability exists in IBM WebSphere Application Server's XML processing components. When the application parses XML input from untrusted sources, it fails to properly restrict external entity references. This allows attackers to craft malicious XML payloads containing external entity declarations that reference sensitive local files or internal network endpoints.

The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference). The attack can be executed remotely over the network, though the complexity is considered high as it requires specific conditions to be exploitable. No authentication is required to attempt exploitation.

Root Cause

The root cause of this vulnerability lies in the insecure default configuration of the XML parser within IBM WebSphere Application Server. The XML processing components do not properly disable external entity resolution and DTD processing, allowing attackers to inject malicious entity declarations. When the parser encounters these declarations, it attempts to resolve the external references, leading to information disclosure, SSRF, or resource exhaustion.

Attack Vector

The attack vector for CVE-2024-22354 is network-based, targeting any endpoint in IBM WebSphere Application Server that accepts and processes XML input. An attacker can exploit this vulnerability by sending a specially crafted XML document containing external entity declarations to the vulnerable server.

The malicious XML payload typically includes a DOCTYPE declaration with external entity references pointing to local files (for information disclosure), internal network endpoints (for SSRF), or recursive entity expansions (for denial of service). When the server parses this XML, it resolves the external entities, allowing the attacker to exfiltrate sensitive data or probe internal resources.

A typical XXE attack against this vulnerability would involve crafting an XML document with a DOCTYPE declaration containing an ENTITY that references a local file path such as /etc/passwd or Windows system files. When processed, the server resolves the entity and may include the file contents in response messages or error output. For SSRF attacks, the entity reference would point to internal HTTP endpoints, allowing the attacker to map internal network infrastructure. See the IBM X-Force Vulnerability #280401 for additional technical details.

Detection Methods for CVE-2024-22354

Indicators of Compromise

• Unusual XML requests containing DOCTYPE declarations with ENTITY or SYSTEM keywords
• Server logs showing attempts to access local file paths like /etc/passwd, /etc/shadow, or Windows system files
• Outbound connections from the WebSphere server to unexpected internal IP addresses or external hosts
• Error messages containing file contents or path disclosure information

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XML payloads containing DOCTYPE declarations with external entity references
• Monitor application logs for XML parsing errors or exceptions related to external entity resolution
• Deploy network intrusion detection systems (IDS) with signatures for common XXE attack patterns
• Review access logs for requests containing suspicious XML content targeting API endpoints or web services

Monitoring Recommendations

• Enable verbose logging for XML processing components in WebSphere Application Server
• Monitor for unusual file access patterns from the WebSphere process, particularly to sensitive configuration files
• Track outbound network connections from the application server to identify potential SSRF activity
• Implement alerting for high memory consumption that could indicate entity expansion attacks (Billion Laughs)

How to Mitigate CVE-2024-22354

Immediate Actions Required

• Apply the IBM security patch as documented in the IBM Support Patch Advisory
• Review all XML processing endpoints and ensure external entity resolution is disabled
• Implement input validation to reject XML documents containing DOCTYPE declarations from untrusted sources
• Deploy network segmentation to limit the impact of potential SSRF attacks

Patch Information

IBM has released security updates to address this vulnerability. Organizations running affected versions of IBM WebSphere Application Server should apply the patches immediately. Detailed patch information and installation instructions are available in the IBM Support Patch Advisory. IBM has assigned X-Force ID 280401 to track this vulnerability.

Workarounds

• Configure XML parsers to disable DTD processing and external entity resolution
• Implement strict input validation that rejects XML documents with DOCTYPE declarations
• Use application-level filtering to strip or sanitize XML input before processing
• Deploy a web application firewall with XXE attack detection capabilities as an interim measure

To mitigate XXE vulnerabilities in Java-based XML processing, configure the XML parser factory to disable external entities and DTD processing. Set the features disallow-doctype-decl to true, external-general-entities to false, and external-parameter-entities to false on your XMLParserFactory or DocumentBuilderFactory. Additionally, set the XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_SCHEMA attributes to empty strings. Consult the IBM Support Patch Advisory for WebSphere-specific configuration guidance.