Session Cookie Theft via XSS in Trimble TM4WEB

Executive Summary

This vulnerability affects Trimble's TM4WEB software versions 22.2.0 and earlier due to a security misconfiguration in session identifiers. Attackers can recover valid session cookies via reflected cross-site scripting (XSS) targeting the external document viewer endpoint. The session cookies UID, rstring, and PHPSESSIONID lack the HttpOnly flag, making them accessible through JavaScript execution. They also should have the SECURE flag enabled to prevent transmission over unencrypted channels.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the session cookies (UID, rstring, PHPSESSIONID) for missing HttpOnly and SECURE flags. Use browser developer tools to check cookie attributes or network requests. Test for reflected XSS in the external document viewer endpoint by injecting simple payloads like <script>alert(1)</script>.

Commands: Use curl to inspect cookies: curl -I http://target-url. Check for XSS via: curl 'http://target-url/viewer?param=<script>alert(1)</script>'. Verify cookie flags with browser dev tools or tools like OWASP ZAP.

Useful 0 Not Useful 0

Impact Analysis

Authenticated users can have their sessions and accounts hijacked by attackers exploiting this unauthenticated XSS vulnerability. An attacker can inject malicious JavaScript via a separate reflected XSS vulnerability (CVE-2022-35499) to capture session cookies and redirect them to an attacker-controlled server.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately enable HttpOnly and SECURE flags for all session cookies (UID, rstring, PHPSESSIONID). Patch or update TM4WEB to the latest version. Implement input validation and output encoding to prevent XSS. Use Content Security Policy (CSP) headers to mitigate XSS risks.

Useful 0 Not Useful 0