CVE-2025-3630: IBM Sterling B2B Integrator XSS Vulnerability

CVE-2025-3630 Overview

CVE-2025-3630 is a stored cross-site scripting (XSS) vulnerability affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows authenticated users to embed arbitrary JavaScript into the Web UI, which executes in the context of other users' trusted sessions. Successful exploitation can lead to credential disclosure, session manipulation, and modification of intended application behavior. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can store malicious JavaScript in the Web UI, leading to credential theft and session hijacking against other authenticated users of the Sterling B2B Integrator or Sterling File Gateway console.

Affected Products

IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4
Deployments on IBM AIX, Linux, and Microsoft Windows host operating systems

Discovery Timeline

2025-07-08 - CVE-2025-3630 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3630

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Sterling B2B Integrator and Sterling File Gateway Web UI. An authenticated user with access to an input field that is persisted and later rendered to other users can inject JavaScript payloads. When another authenticated user loads the affected page, the browser executes the attacker-controlled script within the application's origin.

Because the payload runs inside a trusted session, it can read Document Object Model (DOM) content, exfiltrate session identifiers, submit forms on behalf of the victim, or alter displayed workflow data. The scope change in the CVSS vector reflects that the injected script executes in the browser context of a separate authenticated user. Exploitation requires low privileges on the attacker side and user interaction from the victim.

Root Cause

The root cause is improper neutralization of user-supplied input before it is included in Web UI responses. Input stored by one user is rendered to other users without sufficient output encoding or sanitization, allowing script content to be interpreted by the browser instead of displayed as text.

Attack Vector

The attack is delivered over the network through the application's Web UI. An authenticated attacker submits a crafted payload into a persisted field. A victim user, often a privileged operator or administrator, later views the page containing that field and executes the stored JavaScript. The attacker payload can then issue authenticated requests, harvest tokens from cookies accessible to JavaScript, or capture credentials from form interactions within the trusted session.

No verified public proof-of-concept code is available for this issue. For technical remediation details, refer to the IBM Support advisory for CVE-2025-3630.

Detection Methods for CVE-2025-3630

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in Sterling B2B Integrator or Sterling File Gateway data fields, mailbox metadata, partner profiles, or workflow descriptions.
Browser requests originating from Sterling UI pages toward external hosts not associated with legitimate integrations.
Anomalous outbound HTTP POST traffic from administrator workstations immediately after loading Sterling B2B Integrator Web UI pages.

Detection Strategies

Inspect database tables and audit logs for stored values containing HTML or JavaScript control characters within user-editable fields.
Review Web Application Firewall (WAF) and reverse proxy logs for script-like payloads submitted to Sterling B2B Integrator or Sterling File Gateway endpoints.
Correlate authenticated session activity with sudden JavaScript-triggered requests to unknown domains using endpoint and browser telemetry.

Monitoring Recommendations

Enable detailed audit logging on all Sterling B2B Integrator write operations and retain logs for forensic review.
Monitor administrator and operator sessions for unexpected API calls, especially those creating accounts or modifying partner configurations.
Alert on repeated failed input validation events or WAF blocks tied to Sterling UI URIs.

How to Mitigate CVE-2025-3630

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support advisory to all affected Sterling B2B Integrator and Sterling File Gateway instances.
Restrict Web UI access to trusted networks and enforce multi-factor authentication for all administrative accounts.
Audit existing stored content in user-editable fields for prior injection attempts and sanitize or remove suspicious entries.

Patch Information

IBM has published remediation guidance for Sterling B2B Integrator and Sterling File Gateway in the IBM Support bulletin. Upgrade affected deployments to the fixed releases identified by IBM for the 6.1.x and 6.2.x branches. Confirm that both the Sterling B2B Integrator core and the Sterling File Gateway add-on are updated, as both products share the vulnerable codebase.

Workarounds

Deploy a WAF rule set that blocks common XSS payload patterns on Sterling B2B Integrator and Sterling File Gateway Web UI endpoints until patches are applied.
Enforce a strict Content Security Policy (CSP) at the reverse proxy to limit inline script execution within the Sterling Web UI.
Reduce the number of accounts with write access to persisted UI fields and review partner onboarding workflows for untrusted input.

bash

# Example reverse-proxy CSP header for Sterling B2B Integrator UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;