IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
No product patch or software update is required.
Background:
The WmServiceMock package relies on Integration Server authentication and does not implement a separate authentication mechanism. This package is a development-time testing utility designed exclusively for development and testing environments.
Required Action:
Remove the WmServiceMock package from any production Integration Server node. The package should not be deployed on internet-facing or production systems.
Steps to Remove the WmServiceMock Package:
- Log in to Integration Server
- Navigate to Packages > Management
- Locate the WmServiceMock package in the package list
- Click the "Delete" icon next to WmServiceMock
- Confirm the deletion when prompted
- Restart the Integration Server to complete the removal
For Development/Testing Environments Only:
If you must retain WmServiceMock for development or testing purposes:
- Ensure the package is deployed only in isolated, non-production environments
- Verify Integration Server authentication is enabled:
- Navigate to Server > Ports in Integration Server
- Review port security settings and client certificate handling
- Confirm authentication is enforced for all ports
- For detailed security configuration, refer to:
- Integration Server Security: Integration Server Security - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0
- Configuring Port Security: Configuring How Ports Handle Client Certificates - IBM Documentation https://www.ibm.com/docs/en/webmethods-integration/wm-integration-server/11.1.0
Important: The WmServiceMock package should not be exposed to internet-facing networks or deployed in production systems.