IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 s Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries
Weakness
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Websphere_extreme_scale | Ibm | 8.6.1.0 (including) | 8.6.1.6 (including) |