CVE-2025-36135: IBM Sterling B2B Integrator XSS Vulnerability

CVE-2025-36135 Overview

CVE-2025-36135 is a stored cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows an authenticated user to embed arbitrary JavaScript code in the Web UI. Successful exploitation alters the intended functionality of the application and can lead to credential disclosure within a trusted session.

The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). IBM published a security bulletin covering affected releases and fix packs.

Critical Impact
Authenticated attackers can inject JavaScript into the Sterling Web UI, hijack trusted sessions, and exfiltrate credentials from other users of the platform.

Affected Products

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0

Discovery Timeline

2025-11-07 - CVE-2025-36135 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36135

Vulnerability Analysis

The vulnerability resides in the Sterling B2B Integrator and Sterling File Gateway Web UI. The application fails to properly neutralize user-supplied input before rendering it in HTML responses. An authenticated user can submit input containing JavaScript payloads through an affected UI field. When another user loads the affected page, the browser executes the attacker-controlled script in the context of the Sterling application origin.

Because the payload runs within an authenticated session, scripts can access session cookies, Document Object Model (DOM) contents, and application state. Attackers can harvest credentials from login prompts, impersonate privileged administrators, and manipulate B2B transaction workflows. The scope change in the CVSS vector reflects that the injected script can impact resources beyond the vulnerable component, such as other authenticated users browsing the same instance.

Root Cause

The root cause is improper output encoding of user-controlled input rendered into the Web UI. Input stored or reflected by Sterling B2B Integrator is placed into HTML, JavaScript, or attribute contexts without context-aware escaping. This classifies the issue as CWE-79.

Attack Vector

Exploitation requires network access to the Sterling Web UI and valid, low-privilege credentials. The attacker submits a crafted payload through a field that is later rendered to another user, typically an administrator. User interaction is required: the victim must load the page containing the injected script. Once triggered, the payload executes in the victim's browser under the Sterling application origin and can issue authenticated requests on their behalf.

No verified public exploit code is available for CVE-2025-36135. Refer to the IBM Support Document for vendor-provided technical details.

Detection Methods for CVE-2025-36135

Indicators of Compromise

Sterling B2B Integrator or File Gateway form fields containing <script>, onerror=, javascript:, or encoded variants in audit logs.
Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains.
Session cookies or authentication tokens appearing in web server referrer logs or external telemetry.
Unusual configuration changes performed by administrators who did not initiate them.

Detection Strategies

Review Sterling B2B Integrator access and audit logs for POST or PUT requests containing HTML or JavaScript tags in parameters.
Deploy a web application firewall (WAF) rule set covering OWASP Core Rule Set XSS signatures in front of the Sterling Web UI.
Enable browser Content Security Policy (CSP) reporting to capture script-source violations on Sterling pages.
Correlate authenticated user sessions with anomalous DOM-based network traffic patterns.

Monitoring Recommendations

Monitor administrative accounts for session activity originating from unexpected IP addresses or user agents.
Alert on repeated requests containing XSS payload markers against Sterling B2B Integrator endpoints.
Track changes to trading partner configurations, user accounts, and routing rules performed outside maintenance windows.

How to Mitigate CVE-2025-36135

Immediate Actions Required

Apply the fix packs listed in the IBM Support Document for the affected 6.0.x, 6.1.x, 6.2.0.x, and 6.2.1.x release lines.
Restrict Sterling Web UI access to trusted internal networks and VPN users only.
Audit user accounts and revoke credentials for inactive or unnecessary low-privilege users.
Reset session tokens and credentials for any accounts that may have been exposed during the vulnerable window.

Patch Information

IBM has released fixes addressing CVE-2025-36135 for IBM Sterling B2B Integrator and IBM Sterling File Gateway across the 6.0, 6.1, 6.2.0, and 6.2.1 release lines. Customers should upgrade to the fix pack identified in the IBM Support Document that applies to their deployed version. Verify fix pack compatibility with any installed interim fixes before applying.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on the Sterling Web UI reverse proxy.
Deploy a WAF with XSS filtering rules in front of Sterling B2B Integrator until the patch is applied.
Limit UI access to a minimal set of administrators and require multi-factor authentication for all logins.
Educate users to avoid clicking unexpected links or opening unknown Sterling UI pages shared by other users.

bash

# Example nginx reverse proxy CSP header for the Sterling Web UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;