Critical Trust & Isolation Failures in IBM Platforms: JWT Admin Takeover and Container Command Execution (CVE-2025-36418 & CVE-2025-36059)

IBM ApplinX – JWT Privilege Escalation (Admin Impersonation)

Product overview (at top)
IBM ApplinX is an application modernization and integration platform that exposes backend systems through web and API interfaces. Authentication and authorization are handled using JSON Web Tokens (JWTs). A weakness in JWT validation logic allows privilege escalation through token manipulation, leading to full administrative impersonation.

CVE Summary – Basic Information

Field	Details
Vulnerability name	JWT Privilege Escalation – Admin Impersonation
CVE ID	CVE-2025-36418
Affected product	IBM ApplinX
Vulnerability type	Authentication bypass / Privilege escalation
Attack vector	Network (remote)
Authentication required	No
User interaction	None
Impact	Unauthorized admin access, configuration changes, data exposure
Exploitability	High
Public PoC	Not publicly released (educational analysis only)
Severity	High

Technical Vulnerability Details

Improper validation of JSON Web Tokens is present in affected versions of ApplinX. JWTs received by the application are not consistently verified for cryptographic integrity and trusted claim enforcement. As a result, token headers and payloads may be modified without detection.

In specific execution paths, token signature verification is either skipped or incorrectly trusted, allowing attacker-supplied claims to be accepted as legitimate. Claims related to identity (sub), role assignment, or administrative privileges are processed without strict verification against a trusted issuer.

Because JWTs are used directly for authorization decisions, any flaw at this layer results in full compromise of access control.

How Exploitation Occurs

The vulnerability is exploited by supplying a crafted JWT to the application:

A JWT is created or altered by the attacker.
Privileged claims such as administrative roles are added to the token payload.
The token is signed using an invalid or weak signature, or left unsigned.
The application accepts the token without proper validation.
The attacker is treated as an administrator by the system.

No existing account is required. No user interaction is required. The exploit is entirely remote if the application endpoint is reachable.

Educational PoC Characteristics

While no public exploit has been released, exploitation techniques would typically include:

JWT header set to alg: none
JWT signed with an unexpected algorithm
Modified role, isAdmin, or sub claims
Reuse of expired or replayed tokens
Abuse of weak or static signing keys

These behaviors are well-known JWT abuse patterns and are included here strictly for defensive and educational understanding.

MITRE ATT&CK & CWE Mapping

CWE-347 – Improper Verification of Cryptographic Signature
CWE-522 – Insufficiently Protected Credentials
ATT&CK T1078 – Valid Accounts (Impersonation)
ATT&CK T1550 – Use of Alternate Authentication Material

Detection Strategy

Recommended Log Sources

ApplinX authentication and authorization logs
Application server access logs
Reverse proxy or WAF logs
Identity provider (IdP) logs if federated authentication is used

Suspicious Indicators

Tokens accepted with invalid or missing signatures
Administrative actions performed without corresponding admin login events
JWTs containing elevated claims from unknown IP addresses
Repeated authentication attempts using different JWT payloads
Tokens using unexpected signing algorithms

Splunk Detection Rules

Rule 1 – JWT Signature Validation Failure

index=applinx_logs
| where jwt_signature_verified="false"
| stats count by src_ip, user, jwt_algorithm, _time
| where count > 1

Rule 2 – Admin Claim Without Admin Login

index=applinx_logs
| where jwt_role="admin" AND authenticated_user!="admin"
| stats count by src_ip, authenticated_user, jwt_role

Rule 3 – Suspicious JWT Algorithms

index=applinx_logs
| where jwt_algorithm="none" OR jwt_algorithm NOT IN ("RS256","HS256")
| stats count by src_ip, jwt_algorithm

Risk & Business Impact

If exploited, this vulnerability allows:

Full administrative access
Unauthorized configuration changes
Data theft or manipulation
Credential harvesting
Lateral movement into connected systems

This vulnerability represents a direct compromise of trust boundaries and should be treated as critical in externally exposed environments.

Remediation & Hardening Guidance

Vendor patches must be applied immediately.
JWT signature validation must be enforced without exceptions.
Tokens using alg:none must be rejected.
Issuer (iss), audience (aud), expiration (exp) and key ID (kid) must be validated.
JWT signing keys must be rotated after patching.
External access should be restricted until remediation is complete.

Official Patch / Upgrade Link

IBM ApplinX – Official Security Fix
https://www.ibm.com/support/fixcentral

(Search for ApplinX security update addressing CVE-2025-36418)

IBM Business Automation Workflow Containers – OS Command Execution

Product overview (at top)
IBM Business Automation Workflow is distributed as container images within IBM Cloud Pak for Business Automation. A container misconfiguration allows execution of operating system commands beyond intended boundaries, enabling container escape scenarios.

CVE Summary – Basic Information

Field	Details
Vulnerability name	OS Command Execution / Container Escape
CVE ID	CVE-2025-36059
Affected product	IBM Business Automation Workflow (Containers)
Vulnerability type	Privilege escalation
Attack vector	Local
Authentication required	Yes (container access)
User interaction	None
Impact	Host compromise, lateral movement
Exploitability	Moderate
Public PoC	Not publicly released
Severity	Medium

Technical Vulnerability Details

The vulnerability exists due to excessive privileges and unsafe system call exposure within the container runtime configuration. A user who gains access to the container is able to execute commands that interact with the underlying host operating system.

Improper isolation between container and host allows privileged operations such as namespace traversal, host file access, or process manipulation. This breaks the expected container security boundary.

Exploitation Flow

Access to a running container is obtained.
OS-level commands are executed inside the container.
Container isolation controls are bypassed.
Host resources or other containers are accessed.

This vulnerability is typically chained with another weakness such as weak credentials or exposed exec access.

Detection Strategy

Log Sources

Kubernetes audit logs
Container runtime logs (containerd, Docker, runc)
Host syslog and process audit logs

Indicators

Unexpected kubectl exec activity
Shells spawned inside containers
Host file paths accessed from container processes
Privileged syscalls invoked by non-privileged pods

Splunk Detection Rules

Rule 1 – Container Exec Monitoring

index=kube_audit
| where verb="exec"
| stats count by user, src_ip, pod

Rule 2 – Suspicious Container Processes

index=container_logs
| where process_name IN ("sh","bash","nsenter","setns")
| stats count by container_id, process_name

Rule 3 – Host Access From Container

index=host_logs
| where process_user="container" AND file_path LIKE "/proc/1/%"
| stats count by process_name, file_path

Mitigation Guidance

Official container images must be updated.
Containers must not run as root.
Linux capabilities must be reduced.
Pod security policies or standards must be enforced.
Exec access must be restricted via RBAC.
Runtime monitoring should be enabled.

Official Patch / Upgrade Link

IBM Cloud Pak for Business Automation – Container Updates
https://www.ibm.com/support/pages/cloud-pak-business-automation

Final Takeaway

Both vulnerabilities impact core trust and isolation mechanisms. Immediate patching combined with enhanced detection is strongly recommended. Detection rules should be tuned to environment-specific fields before deployment.