IBM i Host Header Injection Vulnerability in Navigator for i

A host header injection vulnerability has been identified in IBM i versions 7.3, 7.4, 7.5, and 7.6. This vulnerability arises from improper neutralization of HTTP header content by IBM Navigator for i, allowing authenticated users to manipulate the host header in HTTP requests. This manipulation can change the domain or IP address, potentially leading to unexpected behavior.

Impact

Exploitation of this vulnerability could result in host header injection, allowing for manipulation of the host header in HTTP requests. This could lead to unexpected behavior on the server.

Remediation

Users can apply a PTF to IBM i to address this vulnerability. The PTF numbers for the fixed version are SJ04647 for 7.6, SJ03406 for 7.5, SJ03404 for 7.4, and SJ03402 for 7.3. These PTFs can be downloaded from the IBM My Support portal.