CVE-2025-1349: IBM Sterling B2B Integrator XSS Vulnerability

CVE-2025-1349 Overview

CVE-2025-1349 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw exists in versions 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4. A privileged user can embed arbitrary JavaScript in the Web UI, altering intended functionality. Successful exploitation may lead to credential disclosure within a trusted session.

Critical Impact
A privileged attacker can inject persistent JavaScript into the Sterling Web UI, hijack authenticated sessions of other users, and exfiltrate credentials or transaction data flowing through B2B file exchange workflows.

Affected Products

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
Deployments on IBM AIX, Linux, and Microsoft Windows host operating systems

Discovery Timeline

2025-06-18 - CVE-2025-1349 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1349

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Sterling B2B Integrator and Sterling File Gateway Web UI. Input submitted by a privileged user is persisted server-side and later rendered in another user's browser without adequate output encoding. The stored payload executes in the victim's authenticated session context. Because Sterling B2B Integrator brokers business-critical file transfers between trading partners, session compromise can expose credentials, partner configurations, and file transfer metadata.

Exploitation requires an authenticated attacker with high privileges and user interaction from the victim who views the injected content. The scope is changed, meaning the injected script executes with access to resources beyond the vulnerable component's original security boundary. Confidentiality and integrity impacts are limited to what the victim session can reach.

Root Cause

The root cause is improper neutralization of user-supplied input during Web page generation. The application accepts input from privileged users and stores it in the backend without applying context-aware output encoding when rendering the value in HTML, attribute, or JavaScript contexts. Any browser retrieving the affected page interprets the payload as executable script.

Attack Vector

An authenticated attacker with elevated privileges submits input containing JavaScript through an affected Web UI field. The payload is stored in the application database. When another authenticated user, such as an administrator, navigates to the page rendering that field, the script executes within their browser session. The attacker can then read Document Object Model (DOM) contents, issue authenticated requests to the Sterling API, or exfiltrate session tokens to an attacker-controlled endpoint.

No verified public exploit code is available for CVE-2025-1349. Refer to the IBM Support advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-1349

Indicators of Compromise

Unexpected <script>, onerror=, or javascript: strings persisted in Sterling B2B Integrator configuration fields, partner profiles, or mailbox metadata.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading Sterling Web UI pages.
Anomalous API calls originating from admin sessions that do not match normal workflow patterns.

Detection Strategies

Review Sterling audit logs for privileged users editing UI-facing fields with content containing HTML tags or JavaScript event handlers.
Deploy a Content Security Policy (CSP) report-only endpoint and monitor violation reports for script execution from Sterling origins.
Correlate Web application firewall (WAF) logs with Sterling access logs to identify payloads submitted to form endpoints.

Monitoring Recommendations

Alert on privileged account activity outside of maintenance windows in Sterling B2B Integrator and File Gateway.
Monitor browser telemetry from administrator workstations for unusual DOM modifications or credential form submissions to non-Sterling domains.
Track configuration change events and diff stored field values against known-good baselines.

How to Mitigate CVE-2025-1349

Immediate Actions Required

Apply the IBM-provided fix documented in the IBM Support advisory for CVE-2025-1349.
Audit privileged user accounts in Sterling B2B Integrator and File Gateway and remove unused administrative access.
Rotate credentials and session tokens for any account that may have viewed attacker-controlled UI content.

Patch Information

IBM has released fixes addressed in the vendor advisory. Upgrade Sterling B2B Integrator and Sterling File Gateway to a fixed release beyond 6.1.2.6 in the 6.1 branch or beyond 6.2.0.4 in the 6.2 branch, as directed by IBM. Confirm build numbers post-upgrade against the versions listed by IBM.

Workarounds

Restrict access to the Sterling Web UI to a limited administrative network segment until patching is complete.
Enforce a strict Content Security Policy that disallows inline script execution on the Sterling Web UI where supported.
Require multi-factor authentication for all privileged Sterling accounts to reduce the value of stolen session material.

bash

# Example: restrict Sterling Web UI access at the reverse proxy layer
# nginx snippet - allow only admin subnet, deny all others
location /dashboard/ {
    allow 10.10.20.0/24;
    deny  all;
    proxy_pass http://sterling-backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}