CVE-2025-36054 Overview
CVE-2025-36054 is a reflected cross-site scripting (XSS) vulnerability affecting IBM Business Automation Workflow containers and IBM Business Automation Workflow traditional with Process Federation Server. The flaw allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality. Successful exploitation requires user interaction and can lead to credential disclosure within a trusted session. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
An unauthenticated attacker can inject JavaScript into the Business Automation Workflow Web UI, hijack authenticated sessions, and disclose user credentials submitted within a trusted browser session.
Affected Products
- IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006
- IBM Business Automation Workflow containers 24.0.1 through 24.0.1-IF004 and 25.0.0 through 25.0.0-IF001
- IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0
Discovery Timeline
- 2025-11-06 - CVE-2025-36054 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36054
Vulnerability Analysis
The vulnerability is a cross-site scripting flaw in the Web UI of IBM Business Automation Workflow. The affected components fail to properly neutralize user-supplied input before rendering it in HTTP responses. An attacker crafts a malicious URL or request containing JavaScript payloads, then delivers it to a target user through phishing or social engineering. When the victim's browser loads the response, the injected script executes in the context of the Business Automation Workflow origin.
Because the CVSS scope is changed, the injected script can act beyond the initially vulnerable component and reach other trusted resources shared with the victim's session. This enables theft of authentication tokens, session cookies, and credentials entered into login forms. The attack requires no privileges but does require the victim to interact with the crafted content.
Root Cause
The root cause is improper output encoding of user-controlled input rendered by the Web UI. Input fields or URL parameters processed by the Process Federation Server component are reflected into the HTML response without adequate contextual sanitization, allowing HTML and JavaScript to be interpreted by the browser.
Attack Vector
The attack vector is network-based and requires user interaction. An unauthenticated attacker constructs a URL containing an XSS payload targeting a vulnerable endpoint in the Business Automation Workflow Web UI. The attacker distributes the URL through email, chat, or a compromised web page. When an authenticated user follows the link, the script executes with the privileges of that user's session, enabling credential harvesting and unauthorized actions against the workflow platform.
Detection Methods for CVE-2025-36054
Indicators of Compromise
- HTTP request logs containing script tags, javascript: URIs, event handlers such as onerror= or onload=, or URL-encoded equivalents in query parameters targeting Business Automation Workflow endpoints.
- Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading a Business Automation Workflow page.
- Anomalous session activity, including logins from new geolocations shortly after users click external links referencing the workflow Web UI.
Detection Strategies
- Deploy a web application firewall (WAF) with signatures for reflected XSS patterns targeting Business Automation Workflow request paths.
- Correlate web server access logs with authentication events to identify credential reuse from unfamiliar sources following suspicious URL access.
- Monitor Content Security Policy (CSP) violation reports from browsers to surface inline script execution attempts.
Monitoring Recommendations
- Enable verbose HTTP request logging on IBM HTTP Server or ingress controllers fronting Business Automation Workflow deployments.
- Alert on URL parameters exceeding expected length or containing HTML control characters (<, >, ", ') directed at Process Federation Server endpoints.
- Track user agent, referer, and geolocation deviations tied to Business Automation Workflow authentication sessions.
How to Mitigate CVE-2025-36054
Immediate Actions Required
- Apply the fixes referenced in the IBM Support advisory for all affected Business Automation Workflow containers and Process Federation Server installations.
- Restrict access to the Business Automation Workflow Web UI to trusted networks or VPN-connected users where possible.
- Educate users on the risks of clicking untrusted links referencing internal workflow URLs.
Patch Information
IBM has published remediation guidance in the vendor advisory at IBM Support Page node 7250261. Administrators should upgrade beyond 24.0.0-IF006, 24.0.1-IF004, and 25.0.0-IF001 for container deployments, and apply the corresponding traditional deployment fixes for Process Federation Server 24.0.0, 24.0.1, and 25.0.0.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Configure the HttpOnly and Secure flags on session cookies to reduce the value of stolen tokens through XSS.
- Deploy WAF rules that block requests containing script fragments or HTML control characters against Business Automation Workflow endpoints until patches are applied.
# Example WAF rule concept (ModSecurity syntax) to block reflected XSS payloads
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
"id:1003654,phase:2,deny,status:403,log,msg:'Potential XSS targeting BAW (CVE-2025-36054)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
