Industry News

IBM Censors Security Researcher for Releasing Vulnerability PoC after Patch

A vulnerability affecting IBM’s WebSphere has been reported by security researcher Maurizio Agazzini, but the company requested censorship of the proof-of-concept.

Although working with the company in developing a fix and patching affected products, IMB has allegedly pressured the developer into removing the proof-of-concept for the vulnerability, as it could have still affected customers yet to install the fix. While Agazzini complied, it wasn’t without posting an excerpt of the email received from IBM.

IBM Censors Security Researcher for Releasing Vulnerability PoC after Patch

Reported under CVE-2016-5983, the vulnerability affects IBM’s WebSphere versions 7, 8, 8.5, and 9, by allowing “remote authenticated users to execute arbitrary Java code via a crafted serialized object”.  Successfully exploiting the vulnerability could lead to DoS (denial-of-service) attacks and even remote execution of malicious code.

While the PoC has since been removed, details on how the attack can be reproduced are still available and anyone with the right technical skills can write their own PoC.

“The attack can be reproduced as follows:

  • Create an application with custom form authentication
  • After user login, the LtpaToken2 is set by the application server
  • Make an HTTP GET request that contains the WASPostParam cookie.”

IBM’s response to inquiries on why they specifically asked the security researcher to drop the proof-of-concept suggests they’re mostly interested in their customer’s safety, as some might not be able to timely apply the patch.

“Though the patch is now available, we understand many organizations can’t always apply patches immediately,” said IBM. “While not the normal IBM practice, in this specific case, we asked for some of the exploit details to be redacted to protect vulnerable users and allow them time to patch.”

About the author

Liviu ARSENE

Liviu Arsene is the proud owner of the secret to the fountain of never-ending energy. That's what's been helping him work his everything off as a passionate tech news editor for the past couple of years. He is the youngest and most restless member of the Bitdefender writer team and he covers mobile malware and security topics with fervor and a twist. His passions revolve around gadgets and technology, and he's always ready to write about what's hot and trendy out there in geek universe.