CVE-2009-0891 in WebSphere Application Server
Summary
by MITRE
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/20/2025
The vulnerability identified as CVE-2009-0891 affects IBM WebSphere Application Server versions prior to specific fix packs, creating a critical security weakness in the Web Services Security component. This flaw resides in the proper enforcement of nonce and timestamp expiration values within WS-Security bindings, specifically when these values are stored in the com.ibm.wsspi.wssecurity.core custom property. The vulnerability represents a significant failure in authentication and session management mechanisms that are fundamental to secure web service communications.
The technical flaw manifests in the improper handling of security tokens and their associated time-based validation parameters. A nonce is a random or pseudo-random number used once in a cryptographic communication to prevent replay attacks, while timestamp expiration ensures that security tokens remain valid only for a specified time window. When these elements are not properly enforced, authenticated users can exploit the system to hijack active sessions. This weakness directly correlates to CWE-345 Insufficient Verification of Data Authenticity, as the system fails to adequately validate the authenticity and timeliness of security tokens.
The operational impact of this vulnerability is severe for organizations relying on IBM WebSphere Application Server for secure web services. Remote authenticated attackers who can leverage this weakness can conduct session hijacking attacks, potentially gaining unauthorized access to sensitive applications and data. This compromise undermines the integrity of the authentication process and can lead to complete system infiltration. The vulnerability affects multiple major versions of the application server, indicating a widespread issue that would require extensive patch management efforts across organizations.
Organizations should implement immediate mitigations including applying the appropriate fix packs for their specific WebSphere Application Server versions, which address the nonce and timestamp validation issues. Security teams should also consider implementing additional monitoring for suspicious authentication patterns and session behavior. The vulnerability demonstrates the critical importance of proper token management and time-based validation in secure communication protocols. From an ATT&CK perspective, this weakness maps to T1566 Credential Access and T1078 Valid Accounts, as it enables attackers to leverage legitimate credentials for unauthorized access. Organizations must also review their web service security configurations and ensure proper enforcement of security policy parameters to prevent similar vulnerabilities in other components of their infrastructure.