Troubleshooting
Problem
There is a potential vulnerability in deserialization of IData pipelines.
The internal protocol used for transmission of IData pipelines on Integration Server has a feature that supports serialized Java objects.
This poses a risk as, under certain conditions, it is possible to exploit Java applications performing unsafe deserialization of objects to achieve arbitrary code execution. While the vulnerability itself lies in the application performing unsafe deserialization, exploitation of this issue depends on finding property-oriented programming "gadget chains" in libraries used by the application. These gadgets can then be used to construct a malicious serialized payload. While no gadgets to achieve code execution have been found, it is almost certain that with enough time, a motivated attacker could construct a payload to achieve remote code execution through the libraries that are used by Integration Server. Additionally, no vulnerable libraries are needed to exploit the unsafe java deserialization.
Document Location
Worldwide
To view more of this document
Was this topic helpful?
Document Information
More support for:
IBM webMethods Integration
Component:
webMethods Integration Server (PIE)
Software version:
9.12
Operating system(s):
Red Hat Enterprise Linux
Document number:
7221055
Modified date:
20 March 2025
UID
ibm17221055