CVE-2025-36223 Overview
CVE-2025-36223 is an HTTP header injection vulnerability affecting IBM OpenPages 9.0 and 9.1. The flaw stems from improper validation of the Host header, classified under [CWE-644] Improper Neutralization of HTTP Headers for Scripting Syntax. An attacker can manipulate the Host header to conduct cross-site scripting (XSS), web cache poisoning, or session hijacking attacks against users of the vulnerable system. Exploitation requires user interaction and can affect resources beyond the vulnerable component due to the changed scope. IBM published a support advisory addressing the issue.
Critical Impact
Attackers can inject malicious content via the Host header to execute scripts in victim browsers, poison shared caches, or hijack authenticated sessions.
Affected Products
- IBM OpenPages 9.0.0
- IBM OpenPages 9.1.0
Discovery Timeline
- 2025-11-12 - CVE-2025-36223 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36223
Vulnerability Analysis
IBM OpenPages 9.0 and 9.1 process the HTTP Host header without validating or sanitizing its contents. The application reflects or otherwise uses the attacker-supplied header value in downstream responses, links, or cached content. This behavior enables three distinct attack outcomes: reflected cross-site scripting, web cache poisoning, and session hijacking through crafted absolute URLs.
The vulnerability affects the OpenPages governance, risk, and compliance (GRC) platform used by enterprises to manage regulatory workflows. Because OpenPages typically handles sensitive audit, risk, and compliance data, injection into authenticated sessions raises the operational impact beyond generic web XSS.
Root Cause
The root cause is missing input validation on the HTTP Host header before it is consumed by application logic. Per [CWE-644], the application fails to neutralize header values that may contain scripting or control characters. When the value is later used to construct URLs, redirects, cache keys, or embedded content, the attacker-controlled data crosses a trust boundary.
Attack Vector
Exploitation is network-based and requires user interaction, such as clicking a crafted link or loading a poisoned resource. An attacker sends an HTTP request to the OpenPages server with a manipulated Host header pointing to attacker-controlled content or containing script payloads. Downstream victims — including cache consumers or users who follow generated links — receive the malicious content in the context of the legitimate OpenPages origin. No authentication is required to send the malicious request, though the highest-impact outcomes depend on victim interaction with the poisoned response.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-36223
Indicators of Compromise
- HTTP requests to OpenPages containing Host header values that do not match the deployed FQDN or load balancer VIP.
- Server access logs showing Host headers containing angle brackets, quotes, newlines (\r\n), or unexpected external domains.
- Cached responses or generated links referencing external, attacker-controlled hostnames in place of the OpenPages canonical domain.
Detection Strategies
- Inspect web server and reverse proxy logs for Host header values outside an allowlist of expected hostnames.
- Monitor WAF telemetry for header injection signatures targeting Host, X-Forwarded-Host, and X-Host headers.
- Correlate anomalous outbound referrals or redirects from OpenPages sessions with source IP and user-agent metadata.
Monitoring Recommendations
- Enable verbose HTTP request logging on the OpenPages application tier, including full request headers.
- Alert on cache entries where the response body references domains that differ from the canonical OpenPages hostname.
- Track authenticated OpenPages sessions that generate abnormal client-side script execution or unexpected origin redirects.
How to Mitigate CVE-2025-36223
Immediate Actions Required
- Apply the fix documented in the IBM Support Document for OpenPages 9.0 and 9.1.
- Configure the fronting web server or load balancer to reject requests whose Host header does not match the approved FQDN list.
- Audit OpenPages users for signs of session compromise following exposure of the vulnerable endpoint to untrusted networks.
Patch Information
IBM has published remediation guidance in the vendor advisory at IBM Support node 7250239. Administrators of IBM OpenPages 9.0.0 and 9.1.0 should follow the vendor instructions to apply the security update. Verify the deployed build version after patching to confirm remediation.
Workarounds
- Enforce strict Host header allowlisting at the reverse proxy or WAF layer in front of OpenPages.
- Disable or restrict caching of authenticated OpenPages responses at any intermediate CDN or proxy until patching is complete.
- Configure the application server to use an absolute, hardcoded canonical hostname for generated URLs rather than deriving them from the request Host header.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
