IBM DataPower Gateway anfällig für CSRF

A successful CSRF attack could allow an attacker to perform actions as a legitimate user of the DataPower Gateway, potentially leading to unauthorized configuration changes, data manipulation, or even complete system compromise. The attacker would need to trick a user into clicking a malicious link or visiting a crafted webpage. The impact is amplified if the DataPower Gateway is used to manage sensitive data or control critical infrastructure, as an attacker could leverage this vulnerability to gain broader access and control. This vulnerability shares similarities with other CSRF exploits, where user actions are unknowingly hijacked.

Organizations heavily reliant on IBM DataPower Gateway for network security and data management are at increased risk. This includes those using the gateway to manage sensitive data, control critical infrastructure, or integrate with other business-critical systems. Shared hosting environments where multiple users share a DataPower Gateway instance are also particularly vulnerable.

• linux / server:

journalctl -u datapower -g "CSRF attack"

• generic web:

curl -I https://datapower_gateway/ | grep -i 'referer:'

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2025-04-15
2. Veröffentlicht2026-04-01
3. Geändert2026-04-03
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2025-36375 is to upgrade to a fixed version of IBM DataPower Gateway. IBM has not yet released a specific fixed version, so monitor IBM security advisories for updates. As an interim measure, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Consider adding stricter input validation and output encoding to prevent the injection of malicious scripts. Regularly review and audit DataPower Gateway configurations to identify and address potential vulnerabilities.