pn-tester/cve-2022-35499Proof-of-concept exploit for reflected cross-site scripting (XSS) vulnerability in Trimble TM4WEB <=22.2.0, demonstrating injection via arbitrary URL parameters in the external bill viewer endpoint.
In Trimble TM4WEB <=22.2.0 the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
Step 1 :
The following example URL will trigger the vulnerability and execute the javascript alert() function displaying the number 1 as a proof of concept. This vulnerability works on every TM4WEB installation observed so far by the researcher. example malicious url using a non-existant site:
https://example-tm4web.com/trace/external_bill_viewer.msw?foo=bar"}%27);alert(1);<!--
This URL triggers the following malicious GET request.
GET /trace/external_bill_viewer.msw?foo=bar%22}%27);alert(1);%3C!-- HTTP/1.1
Host: example-tm4web.com
Connection: close
This request exploits an arbitrary parameter of the vulnerable external_bill_viewer.msw endpoint.
The attack results in valid javascript code injection in line 84 of the HTTP response, as show in the below screenshot :
Example injection is shown below with resultant JavaScript execution of the alert(1) payload :
