Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Advantech WISE-DeviceOn Server versions prior to 5.4. It occurs in the /rmm/v1/plugin-config/addins/menus endpoint, where an authenticated user can add or edit AddIns menu entries. The label and path values are stored without proper HTML sanitation and later rendered in the AddIns UI. An attacker can inject malicious scripts into these fields, which execute in the browser of users who view or interact with the affected AddIns entry, potentially leading to session compromise and unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to session compromise and unauthorized actions performed by attackers in the context of affected users. Malicious scripts injected via the AddIns menu entries can execute in users' browsers, potentially allowing attackers to hijack sessions, steal sensitive information, or perform actions on behalf of the victim users.

Useful 0 Not Useful 0

Detection Guidance

Detection involves verifying if your Advantech WISE-DeviceOn Server version is prior to 5.4 and checking for suspicious or malicious script injections in the /rmm/v1/plugin-config/addins/menus endpoint, specifically in the 'label' and 'path' fields of AddIns menu entries. You can monitor HTTP requests to this endpoint for unusual input patterns or scripts. Since this is an authenticated stored XSS, commands to inspect logs or HTTP traffic might include using tools like curl or wget to query the endpoint with authenticated sessions, or using web application scanners that detect stored XSS vulnerabilities. Example command to check the version: `curl -k -u <user>:<password> https://<deviceon-server>/api/version` (replace with actual API if available). For detecting malicious entries, manual inspection or automated scanning of the plugin configuration data for script tags or suspicious HTML in 'label' and 'path' fields is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Advantech WISE-DeviceOn Server to version 5.4 or later, where this stored XSS vulnerability has been fixed. Additionally, restrict authenticated user permissions to limit who can add or edit AddIns menu entries, and educate users to avoid interacting with suspicious AddIns entries. Implement web application firewall (WAF) rules to detect and block malicious script injections targeting the /rmm/v1/plugin-config/addins/menus endpoint. [1]

Useful 0 Not Useful 0