CVE-2025-36172: IBM Cloud Pak Business Automation XSS Flaw

CVE-2025-36172 Overview

CVE-2025-36172 is a stored cross-site scripting (XSS) vulnerability in IBM Cloud Pak for Business Automation, specifically affecting the IBM Business Automation Workflow component. An authenticated user can embed arbitrary JavaScript into the Web UI. The injected script executes in the context of other users' trusted sessions when they view the affected content.

Successful exploitation can alter application functionality and lead to credential disclosure. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can persist malicious JavaScript in the Web UI, enabling session-scoped credential theft and unauthorized actions against other authenticated users.

Affected Products

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001
IBM Cloud Pak for Business Automation 24.0.1 through 24.0.1 Interim Fix 004
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 Interim Fix 006 and earlier unsupported releases

Discovery Timeline

2025-11-03 - CVE-2025-36172 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36172

Vulnerability Analysis

The flaw resides in the IBM Business Automation Workflow component of IBM Cloud Pak for Business Automation. User-supplied input is stored server-side and later rendered in the Web UI without sufficient output encoding or input sanitization. When a victim loads the affected page, the browser interprets the attacker-controlled payload as executable JavaScript.

Because the payload is stored rather than reflected, exploitation does not require crafted links or social engineering steps beyond normal application use. Any user who views the injected content triggers the payload within their authenticated session context.

Root Cause

The root cause is improper neutralization of user input during Web UI generation, tracked as [CWE-79]. The application accepts input from an authenticated user and persists it into fields that are subsequently rendered as HTML without contextual encoding. This allows attacker-supplied <script> content or JavaScript-bearing HTML attributes to execute in the DOM of any user who loads the affected view.

Attack Vector

Exploitation requires network access to the Web UI and low-privileged authentication. The attacker submits a crafted payload into a stored field exposed by the Business Automation Workflow interface. When another authenticated user, potentially with higher privileges, views the resource, the payload executes with the victim's session cookies and DOM access.

Because the CVSS scope is changed, the impact extends beyond the vulnerable component to the victim's browser context. Attackers can harvest credentials submitted in the trusted session, exfiltrate tokens, or perform actions on behalf of the victim.

No public proof-of-concept or exploit code has been published for CVE-2025-36172. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2025-36172

Indicators of Compromise

Stored form fields, workflow variables, or process comments containing <script> tags, javascript: URIs, or event-handler attributes such as onerror= and onload=.
Outbound HTTP requests from user browsers to unfamiliar domains carrying session identifiers, cookies, or form data.
Unexpected DOM modifications or script sources loaded within the Business Automation Workflow Web UI.

Detection Strategies

Review web server and application logs for POST and PUT requests to Business Automation Workflow endpoints containing HTML control characters or script-like payloads.
Deploy Content Security Policy (CSP) reporting to identify inline script execution and unauthorized external script loads.
Correlate authenticated user actions with subsequent anomalous behavior from other user sessions, such as unexpected privilege changes or credential resets.

Monitoring Recommendations

Enable audit logging on all Business Automation Workflow forms and fields that render user-controlled content.
Monitor privileged account activity for unusual navigation patterns, particularly views of workflow items authored by low-privileged users.
Alert on browser-side errors and CSP violations reported by client telemetry.

How to Mitigate CVE-2025-36172

Immediate Actions Required

Apply the fix referenced in the IBM Support Page for affected 24.0.0, 24.0.1, and 25.0.0 versions.
Inventory all IBM Cloud Pak for Business Automation deployments and confirm interim fix levels against the affected version list.
Audit stored workflow content for existing malicious payloads and remove any injected scripts.

Patch Information

IBM has published remediation guidance in security bulletin node/7250047. Administrators should upgrade beyond 25.0.0 Interim Fix 001, 24.0.1 Interim Fix 004, and 24.0.0 Interim Fix 006 to the fixed release identified in the bulletin. Unsupported prior releases should be upgraded to a supported version.

Workarounds

Restrict Business Automation Workflow authoring privileges to trusted users while planning the upgrade window.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place a web application firewall in front of the Web UI with rules that block script tags and JavaScript event-handler attributes in submitted fields.

bash

# Example CSP header to restrict inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report