IBM Db2 Mirror for i (web GUI WAR on IBM i Liberty)

Pre-auth RCE chain in IBM Db2 Mirror for i GUI reaches QSECOFR (IBM Db2 Mirror for i)

A detailed, reproducible pre-auth chain against an administrative interface on IBM i is public with no CVE or vendor fix; exposed GUIs should be locked down before it is weaponized.

A researcher write-up shows an unauthenticated exploit chain in the IBM Db2 Mirror for i web interface. Adding a semicolon path parameter (e.g. /Db2MirrorServlet;x/...) makes the AuthFilter's rets[2].equals("Db2MirrorServlet") check miss the servlet while the container still routes the request, bypassing session, BuildTimeStamp and MN checks; a separate skipVald request parameter disables input validation without a login. From there action methods become reachable, leading to arbitrary Java/JSP execution in Liberty and, via a native helper, a local Db2 connection identifying as QSECOFR — IBM i's highest authority. No CVE, no IBM advisory, and affected version list is not stated.

Affected: not stated as a version list — tested against a Db2 Mirror GUI WAR on IBM i V7R5 with a late-2025 GUI build timestamp

Check whether you run the IBM Db2 Mirror for i GUI (a Db2Mirror.war deployed on the IBM i administrative Liberty instance) and whether its web interface is network-reachable. Indicators from the report: requests to /Db2MirrorServlet with a semicolon path parameter (e.g. /Db2MirrorServlet;x/...), requests carrying skipVald=yes/true, and unauthenticated calls that still return application init JSON (getAppInitData) rather than 401/403.

Until IBM issues a fix, restrict the Db2 Mirror for i Liberty GUI to trusted administrative networks (firewall/VPN), and monitor for the semicolon-path and skipVald request patterns above; apply the IBM PTF/advisory as soon as one is published.