Description

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-14T05:16:56.837Z",
  "pubdate": "2026-09-14T05:16:56.837Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the bodyclass parameter of Paessler PRTG versions prior to 23.3.86.1520. This vulnerability permits an attacker to inject arbitrary malicious scripts into the web application's interface, which are subsequently executed in the context of the victim's browser session. By successfully injecting client-side scripts, an attacker can hijack user sessions, bypass security controls, steal sensitive session tokens, or perform unauthorized actions on behalf of the authenticated user. The flaw resides in the improper sanitization of user-supplied input rendered within the Document Object Model (DOM). Given that PRTG is typically deployed as a monitoring solution with administrative access to critical infrastructure, successful exploitation poses a significant risk to the integrity and confidentiality of the monitoring environment. Attackers require the ability to craft a malicious URL or manipulate input fields that reflect into the application's body element to trigger the payload.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw localized in the handling of the 'bodyclass' parameter within the Paessler PRTG web interface. The root cause is the failure of the application to properly sanitize or encode user-provided input before rendering it directly into the HTML 'body' tag's class attribute.\nThe exploitation process occurs when an attacker supplies a crafted input string containing malicious JavaScript payloads into the 'bodyclass' parameter. When a victim, such as an administrator, navigates to a URL containing this crafted input, the PRTG web server reflects the unsanitized string into the DOM of the response page. Because the browser interprets the contents of the class attribute in the context of the HTML document, an attacker can break out of the intended attribute context using characters such as quotes, angle brackets, or event handlers (e.g., 'onload', 'onerror').\nOnce the payload is injected, the script executes within the security context of the origin where the PRTG application is hosted. This execution occurs without requiring additional interactions from the victim other than accessing the malicious link. The impact of such execution is broad; it allows the attacker to access the Document.cookie object to steal session identifiers, perform unauthorized administrative operations via asynchronous HTTP requests (XHR/Fetch) issued from the victim's session, or modify the rendered content of the PRTG dashboard to conduct phishing or social engineering attacks against the organization's staff.\nThe vulnerable component is the web interface rendering engine responsible for processing UI parameters. This flaw affects all PRTG instances running versions before 23.3.86.1520. While the vulnerability requires the victim to be authenticated for maximum impact, the lack of robust output encoding provides an entry point for attackers to execute code in the victim's browser session once they have reached the application interface."
}