IBM i HTTP Server Administration Vulnerability

IBM i operating system versions 7.3, 7.4, 7.5, and 7.6 are affected by a critical vulnerability within the HTTP Server Administration web application. The flaw stems from improper data sanitization, which enables a remote authenticated attacker to bypass standard security constraints. Successful exploitation allows for the execution of arbitrary code with the privileges of the affected web service or the unauthorized retrieval of sensitive system information. Given the nature of IBM i environments, which often manage mission-critical business data, the ability for an authenticated user to elevate privileges or execute commands poses a significant risk to data confidentiality and integrity. Defenders should prioritize auditing user access to the HTTP Server Administration interface and monitoring for anomalous processes spawned by web server sub-processes.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.9, reflecting its severity. If exploited, an attacker gains the ability to execute arbitrary code or perform unauthorized information disclosure, potentially leading to full system compromise of the IBM i instance. This poses a threat to enterprise systems handling sensitive business logic or financial data.

Recommendation

• Apply the latest security patches provided by IBM for versions 7.3, 7.4, 7.5, and 7.6 of the IBM i operating system to remediate the improper data sanitization flaw.
• Audit administrative access logs for the IBM i HTTP Server to identify unauthorized or suspicious authenticated sessions.
• Restrict network access to the HTTP Server Administration interface to trusted management subnets only.