CVE-2025-33008: IBM Sterling B2B Integrator XSS Vulnerability

CVE-2025-33008 Overview

CVE-2025-33008 is a stored cross-site scripting (XSS) vulnerability affecting IBM Sterling B2B Integrator 6.2.1.0 and IBM Sterling File Gateway 6.2.1.0. An authenticated user can embed arbitrary JavaScript in the Web UI. The injected script alters intended functionality and can lead to credential disclosure within a trusted user session. The weakness is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject JavaScript into the Sterling Web UI, hijack trusted sessions, and exfiltrate credentials from other users interacting with the affected pages.

Affected Products

IBM Sterling B2B Integrator 6.2.1.0
IBM Sterling File Gateway 6.2.1.0
Web UI components shared between both products

Discovery Timeline

2025-08-19 - CVE-2025-33008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33008

Vulnerability Analysis

The flaw is a stored cross-site scripting issue in the Sterling B2B Integrator and Sterling File Gateway Web UI. Input submitted by an authenticated user is rendered back in the browser without sufficient output encoding. When another user views the affected page, the browser executes the attacker-supplied JavaScript in the context of the trusted application origin.

Execution inside the authenticated session gives the attacker access to the DOM, cookies not marked HttpOnly, and any client-side tokens. The attack changes the user interaction scope, which explains the elevated impact from a low-privilege actor. Realistic outcomes include credential capture through fake login prompts, session-riding requests against Sterling APIs, and manipulation of file-transfer workflows visible in the UI.

Root Cause

The root cause is missing or insufficient contextual output encoding when persisted user-controlled fields are rendered in the Web UI. Server-side input validation does not neutralize HTML or JavaScript metacharacters before storage, and the rendering layer does not escape them at output time. IBM has not published the specific vulnerable field in the public advisory.

Attack Vector

Exploitation requires network access to the Sterling Web UI and a valid low-privilege account. The attacker submits a crafted payload into a persisted field. A second user with a valid session must view the page containing the stored payload for the script to execute, satisfying the user-interaction requirement. Because scope changes, the executed script can affect resources beyond the vulnerable component, including any browser context sharing the origin.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-33008

Indicators of Compromise

Persisted Sterling UI fields containing <script>, javascript:, onerror=, or onload= substrings.
Outbound browser requests from Sterling UI sessions to unfamiliar domains, consistent with credential exfiltration.
Unexpected authentication prompts or DOM changes reported by Sterling operators.

Detection Strategies

Review application and reverse-proxy logs for POST requests to Sterling B2B Integrator and File Gateway endpoints containing encoded script payloads.
Compare stored records in configuration and workflow tables against a baseline for HTML or JavaScript content in fields expected to hold plain text.
Correlate admin or operator UI sessions with anomalous outbound HTTP requests from the same client IP.

Monitoring Recommendations

Enable verbose Web UI access logging on the Sterling application tier and forward events to a centralized analytics platform.
Add web application firewall (WAF) rules that alert on script tags and event-handler attributes in request bodies targeting Sterling paths.
Monitor for privilege changes, new user creation, or workflow modifications performed shortly after suspicious UI activity.

How to Mitigate CVE-2025-33008

Immediate Actions Required

Apply the fix referenced in the IBM Support Documentation for Sterling B2B Integrator 6.2.1.0 and Sterling File Gateway 6.2.1.0.
Audit existing user-supplied content in Web UI configuration and workflow objects for stored script payloads and remove them.
Rotate credentials and session tokens for accounts that accessed affected UI pages during the exposure window.

Patch Information

IBM has published remediation guidance on the vendor advisory page. Administrators should review the IBM Support Documentation for the fix pack or interim fix applicable to Sterling B2B Integrator 6.2.1.0 and Sterling File Gateway 6.2.1.0, then apply it following IBM's upgrade procedure.

Workarounds

Restrict Web UI access to trusted networks and a minimal set of authenticated operators until patching is complete.
Enforce HttpOnly and Secure flags on session cookies and enable a strict Content Security Policy for Sterling UI hosts.
Require step-up authentication for administrative actions so a hijacked session cannot silently modify workflows.

bash

# Example reverse-proxy hardening for Sterling UI
# Add response headers to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;