Description

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-04T16:17:19.963Z",
  "pubdate": "2026-09-04T16:17:19.963Z",
  "executiveSummary": "Trimble TM4WEB version 21.4.0.4 is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability residing within the external bill viewer endpoint. This security flaw originates from improper input sanitization of arbitrary parameters appended to the application's URL, allowing an attacker to inject and execute malicious client-side scripts within the context of a victim's browser session.\nThe vulnerability poses significant risk to the integrity and confidentiality of user sessions. By crafting a malicious URL containing an embedded script, an attacker can coerce a victim into executing arbitrary JavaScript code. Successful exploitation permits the attacker to hijack user sessions, bypass Same-Origin Policy (SOP) protections, exfiltrate sensitive session cookies or authentication tokens, and manipulate the Document Object Model (DOM) to present fraudulent content.\nThe vulnerability is network-accessible and does not inherently require prior authentication, making it a viable vector for phishing-based attacks. The impact spans from unauthorized account access to the potential deployment of secondary malicious payloads, thereby compromising the security posture of the Trimble TM4WEB installation. Remediation is critical to preventing unauthorized client-side execution and ensuring the safety of user-supplied data rendering.",
  "technicalDetails": "The vulnerability exists within the external bill viewer functionality of Trimble TM4WEB 21.4.0.4. It is classified as a Reflected Cross-Site Scripting (XSS) flaw, resulting from the application's failure to adequately validate or encode arbitrary URL parameters before reflecting them into the HTML response body.\nRoot Cause Analysis: The application's server-side logic processes incoming HTTP GET requests directed at the external bill viewer endpoint. The application takes arbitrary input parameters passed through the URL query string and dynamically renders them within the generated HTML output. Because these parameters lack appropriate output encoding or context-aware sanitization, the application treats user-supplied string data as executable content rather than plain text.\nExploitation Method: An attacker can construct a malicious URL by appending a crafted payload to the vulnerable endpoint's parameters. For example, by injecting common XSS vectors such as '<script>alert(document.cookie)</script>' or event-handler-based injections like '<img src=x onerror=alert(1)>' into the arbitrary parameter, the attacker forces the victim's browser to parse and execute the malicious script upon loading the page.\nAttack Flow: 1. An attacker identifies the vulnerable parameter within the external bill viewer endpoint. 2. The attacker crafts a malicious URL containing an XSS payload. 3. The attacker distributes this URL to a targeted user via social engineering or a malicious link. 4. When the authenticated or unauthenticated user clicks the link, the victim's browser requests the resource from the Trimble TM4WEB server. 5. The server includes the attacker-supplied script in the HTTP response. 6. The victim's browser, receiving the malformed content, executes the injected JavaScript within the security context of the Trimble TM4WEB domain.\nImpact: Upon successful execution, the payload operates within the origin of the Trimble TM4WEB application. This grants the attacker capabilities such as stealing session identifiers, performing unauthorized actions on behalf of the user, logging keystrokes, or redirecting the user to malicious sites. Because the script executes in the client's browser, the security boundary between the user's local session and the web application is effectively breached, allowing for persistent surveillance or session hijacking if the application lacks robust HttpOnly cookie configurations."
}