CVE-2017-1758

Vulnerability

The XML External Entity Injection (XXE) vulnerability exists in multiple IBM products when processing XML data. Affected versions: IBM Financial Transaction Manager (FTM) for ACH Services 3.0.2, 3.0.3, 3.0.4, 3.1.0; FTM for Corporate Payment Services 3.0.2; IBM Control Center 6.0.0.0-6.0.0.2, 6.1.0.0-6.1.0.2 iFix01, 6.1.1.0; and IBM Transformation Extender Advanced 9.0 [1][2][3]. The vulnerability resides in the XML parser used by web services, which processes user-supplied XML without disabling external entity resolution.

Exploitation

An authenticated attacker with low privileges can send a crafted XML request to an affected web service. By including an external entity reference, the XML parser retrieves the specified resource, which can be a local file or an external server, leading to information disclosure or excessive resource consumption [1][2][3]. No user interaction is required beyond the attacker's own authentication.

Impact

Successful exploitation allows an attacker to read arbitrary files on the server (high confidentiality impact) and potentially cause denial of service through memory exhaustion (low availability impact). Integrity is not affected. The CVSS v3.0 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) [1][2][3].

Mitigation

IBM has released fixes: For IBM Transformation Extender Advanced 9.0, upgrade to version 9.0.0.8 [2]. For IBM Control Center, fixes are available in later releases (e.g., 6.0.0.3, 6.1.0.3, 6.1.1.1) [3]. For FTM products, refer to IBM support for the latest fixes. No workarounds are provided [1][2][3].