IBM WebSphere Extreme Scale OQL Constructor Injection

Executive Summary

IBM WebSphere eXtreme Scale's Object Query Language (OQL) engine is vulnerable to remote code execution due to unsafe handling of class names via Class.forName().

An authenticated remote attacker can exploit this vulnerability by influencing OQL query strings to execute arbitrary constructors on the WebSphere Application Server (WAS) JVM.

The vulnerability affects versions 8.6.1.0 through 8.6.1.6 and arises from three attack vectors: SELECT NEW statements, enum literals, and reflection-based comparators.

Additionally, a SELECT DISTINCT variant can trigger the same issue after deserialization, bypassing JEP-290 serialization filters across grid nodes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated remote attacker to execute arbitrary constructors on the WAS JVM, which can lead to remote code execution.

Such execution can compromise the confidentiality, integrity, and availability of the affected system.

If WebSphere eXtreme Scale is used solely as a Session Cache (Session Grid), the risk is mitigated since OQL queries are not executed.

However, in Simple Grid deployments where OQL is used, the system is at high risk of exploitation.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves assessing whether your IBM WebSphere eXtreme Scale deployment uses OQL queries that can be influenced by authenticated remote attackers. Since the vulnerability arises from unsafe handling of class names in OQL queries, monitoring for unusual or unauthorized OQL query strings, especially those containing SELECT NEW statements, enum literals, or reflection-based comparators, is critical.

IBM does not provide specific detection commands or tools in the provided resources. However, general detection steps include reviewing application logs for suspicious OQL query patterns and verifying if versions 8.6.1.0 through 8.6.1.6 are in use.

No explicit commands are suggested in the provided information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps recommended by IBM include:

• Avoid concatenating direct user input into OQL queries.
• Restrict class names used in OQL queries to an allow list.
• Prevent users from modifying OQL syntax.
• Validate all inputs that influence OQL queries.

Additionally, if WebSphere eXtreme Scale is used only as a Session Cache (Session Grid), the risk is mitigated since OQL queries are not executed in that scenario.

No official workarounds are provided, so customers should assess their environments carefully and apply these mitigations promptly.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0