CVE-2022-35499

Executive Summary

CVE-2022-35499 is a reflected cross-site scripting (XSS) vulnerability affecting Trimble TM4WEB versions up to and including 21.4.0.4, specifically in the external bill viewer endpoint. An attacker can inject arbitrary client-side script by appending a crafted parameter to a URL pointing to this endpoint; when a victim opens the malicious link, the script executes in the victim's browser within the TM4WEB application's security context. No official patch has been identified, no public proof-of-concept code is available, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Affected systems are web-bill-payment and invoice-viewing services deployed by Trimble's transportation and logistics customers.

Technical Analysis

The vulnerability exists in the external bill viewer functionality of Trimble TM4WEB version 21.4.0.4. While the NVD description does not disclose the specific vulnerable URL path, servlet, or parameter handling implementation, the flaw class is clearly reported as reflected cross-site scripting (XSS, CWE-79 family).

Vulnerability mechanism at the class level: The affected endpoint reflects an arbitrary user-supplied URL parameter back into the generated HTTP response without sufficient sanitization, encoding, or validation. Because the reflected value is incorporated into the page body (likely within an HTML attribute, JavaScript context, or element content), an attacker can inject executable script. When a remote victim accesses the crafted URL, the browser parses the malicious content and executes the embedded script with the origin and privileges of the TM4WEB application domain.

Attack surface: The endpoint is exposed to "external" users, meaning it may be reachable without prior authentication — typical for vendor-hosted bill-presentment portals where customers click a link in an emailed invoice notification. This broadens the attack surface significantly versus internal-only endpoints. The arbitrary-parameter injection point means the vector is not limited to a fixed parameter name; the attacker controls the parameter name and its value, making defense-in-depth measures that rely on allowlisting specific parameter names ineffective.

No CWE identifier is assigned in the NVD record, but the description explicitly states "reflected cross-site scripting," aligning with CWE-79. The CVSS vector is not published; insufficient data prevents calculating a reliable score. Insufficient technical detail is available regarding the precise rendering context (e.g., whether injection occurs inside an HTML tag attribute, within a <script> block, or in plain HTML body), the character-encoding quirks of the application framework, or whether any filtering is partially applied.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class and the external exposure of the affected endpoint.

Step 1 — Reconnaissance / target identification: An attacker scopes a target organization using TM4WEB 21.4.0.4. Publicly accessible bill-presentment portals are identifiable via search-engine dorks (e.g., inurl:tm4web, intitle:"TM4WEB"), Shodan queries (product:"TM4WEB"), or by scanning a known customer portal range. The external nature of the endpoint means no prior access is required.

Step 2 — Triggering the flaw: The attacker constructs a malicious URL pointing to the external bill viewer endpoint with an arbitrary parameter containing the XSS payload, e.g., https://victim.example/tm4web/billviewer?anything=%3Cscript%3E...%3C/script%3E (the specific path and parameter name are illustrative — the NVD description confirms only that "a arbitrary parameter" is the injection point, not the path).

Step 3 — Payload/execution: The crafted link is delivered to a victim via phishing email, SMS, social-engineering message, or by embedding it in a third-party website. Because the URL appears to reference the legitimate TM4WEB domain, the victim is more likely to click. Once the victim navigates to the link, the server reflects the unescaped payload into the page, and the browser executes the script in the context of the TM4WEB origin. Typical XSS payloads could exfiltrate session cookies, capture keystrokes, perform authenticated actions as the victim (e.g., modifying bill payment settings), or redirect to a credential-harvesting page that mimics the legitimate login.

Step 4 — Post-exploitation impact: The attacker obtains a valid session token or performs unauthorized actions with the victim's privileges. If the exposed bill viewer provides access to payment data, billing records, or PII (company names, addresses, invoice amounts, payment statuses), the attacker can exfiltrate this information. In a business-compromise scenario, hijacking an administrative session could allow configuration changes that redirect payments or alter billing records.

It is essential to note that the external-bill-viewer endpoint is presumably reachable pre-authentication; therefore, the XSS can target unauthenticated users who are invited to view bills — expanding the pool of potential victims significantly.

Impact Assessment

Business impact: The primary concern is the confidentiality and integrity of billing and payment information exposed via the TM4WEB application. Successful exploitation can lead to session hijacking, unauthorized access to customer financial records, account-takeover of portal users, and reputational damage. Because TM4WEB is used in transportation/logistics verticals, a compromise could expose sensitive business-to-business payment information, contract details, and shipment-related billing data.

Affected systems: All deployments of Trimble TM4WEB version 21.4.0.4 (and any earlier versions sharing the vulnerable code path, which are not enumerated) exposed to the internet. Deployments behind a VPN or internal network are lower risk but not immune if an attacker gains initial access.

Blast radius: The attack requires user interaction (clicking a malicious link), which lowers the severity relative to unauthenticated remote code execution; however, the outcome — session-theft and data access within the application — can be severe. Reflected XSS, when combined with phishing in a business-to-business context, may bypass network segmentation and security filters that inspect outbound content, because the payload is delivered in the inbound HTTP response from a trusted domain. A CVSS score has not been published; an estimation based on the class of vulnerability and unauthenticated reachability would be in the medium-to-high range (approximately 6.1–8.2 under CVSSv3.1 criteria), but this is speculative and no official value is available. Exploitation in the wild is not confirmed per CISA KEV.

Detection Guidance

Detecting reflected XSS attempts against this specific vulnerability is challenging without a public exploit template or known attack signature. The following detections focus on generic reflected-XSS indicators: encoded script payloads in URL parameters, HTTP responses returning unescaped <script> markers originating from query strings, and anomalous outbound beaconing afterward.

Sigma Rule

title: Reflected XSS Payload in HTTP Request to TM4WEB Bill Viewer
id: 0fc2b0aa-0a4e-45b1-9f80-9f5f2a3f60c5
status: experimental
description: Detects HTTP GET requests to TM4WEB external bill viewer endpoints containing script-like content in any query parameter, potential CVE-2022-35499 exploitation.
author: Valtersit Threat Intel
logsource:
  category: webserver
  definition: generic web server access logs (IIS, Apache, Nginx, or WAF)
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '%3Cscript%3E'
      - '%3Cscript'
      - '%3C/script%3E'
      - '<script>'
      - 'javascript%3A'
      - 'onerror%3D'
      - '%3Csvg%2Fonload%3D'
  filter_known_good:
    cs-uri-query|contains:
      - 'static'
      - '.css'
      - '.png'
      - '.js'
  condition: selection and not filter_known_good
falsepositives:
  - Security scanners performing benign XSS checks
  - Legitimate applications referencing script URLs in query strings (rare)
level: medium

YARA Rule

rule CVE_2022_35499_TM4WEB_Reflected_XSS
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects URL-encoded XSS payload patterns potentially targeting Trimble TM4WEB external bill viewer reflected XSS (CVE-2022-35499)"
        cve = "CVE-2022-35499"
        date = "2025-02-15"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-35499"

    strings:
        $enc_script_1 = "%3Cscript%3E" ascii
        $enc_script_2 = "%3Cscript" ascii
        $enc_script_end = "%3C%2Fscript%3E" ascii
        $enc_script_end2 = "%3C/script%3E" ascii
        $enc_svg = "%3Csvg%2Fonload" ascii
        $enc_onerror = "onerror%3D" ascii
        $enc_js = "javascript%3A" ascii
        $img_onerror = "%3Cimg%20src%3Dx%20onerror%3D" ascii
        $plain_script = "<script>" ascii
    
    condition:
        uint16(0) == 0x3C21 or   // "<!--" common XML/HTML prefix
        any of ($enc_script*) or any of ($enc_script_end*) or
        any of ($enc_svg*) or any of ($enc_onerror*) or
        any of ($enc_js*) or any of ($img_onerror*) or
        any of ($plain_script)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2022-35499 TM4WEB Reflected XSS - encoded script in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"%3Cscript%3E"; nocase; sid:5000541; rev:1; metadata:created_at 2025_02_15, updated_at 2025_02_15, cve CVE-2022-35499;)

Note: The above rule matches any GET request with an encoded <script> sequence in the URI. For higher fidelity to the specific target, an operator may append a content match on TM4WEB-specific path segments if known from internal inventory, or simply rely on the generic rule and correlation with host metadata (destination = TM4WEB server).

Elastic Detection

any where process.name == "w3wp.exe" or event.category == "web"
  and event.action in ("GET", "request")
  and url.query : (
      "*%3Cscript%3E*",
      "*%3Cscript*",
      "*%3C/script%3E*",
      "*%3Csvg%2Fonload*",
      "*onerror%3D*",
      "*javascript%3A*",
      "*<script>*"
  )
  and destination.port == 443

Splunk SPL Query

index=web sourcetype=access_combined 
| where like(cs_uri_query, "%3Cscript%3E%") 
    OR like(cs_uri_query, "%3Cscript%") 
    OR like(cs_uri_query, "%3C/script%3E%") 
    OR like(cs_uri_query, "onerror%3D%")
    OR like(cs_uri_query, "javascript%3A%")
    OR like(cs_uri_query, "*%3Csvg*")
| stats count by src_ip, dest_host, cs_uri_stem, cs_uri_query, http_user_agent
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web_xss,">
  <rule id="100541" level="10">
    <decoded_as>web</decoded_as>
    <match>%3Cscript%3E|%3Cscript|%3C/script%3E|onerror%3D|javascript%3A|%3Csvg</match>
    <description>CVE-2022-35499 - Potential reflected XSS payload in HTTP request targeting TM4WEB or any web app</description>
    <group>web_application_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and the vendor has not released a fixed version per available data.

Immediate mitigations:

1. Deploy a Web Application Firewall (WAF) in front of the TM4WEB instance with rules to block requests containing common XSS payload patterns in query string parameters. Use both signature-based rules (for <script>, onerror=, javascript:, svg/onload) and heuristic policy that rejects URLs with multiple encoded dangerous characters in any parameter.
2. Restrict network exposure: Place the TM4WEB external bill viewer behind a VPN or require prior authentication / IP allowlisting where business workflows allow. If direct internet exposure is required for bill presentment, apply strict egress filtering and disable untrusted parameter handling by the endpoint where possible.
3. Enable browser-side protections for users: Encourage users to keep browsers updated; however, modern browser XSS filters are often disabled by default and are not a dependable control.
4. Harden proxy configuration: If a reverse proxy fronts the application, configure it to strip or refuse query strings containing HTML-encoded script characters.

Patch/upgrade steps:

1. Monitor Trimble's official security advisories and software update portal for a fixed TM4WEB release. As of this report, no patched version has been identified.
2. When a patched version is released, upgrade to it and verify the external bill viewer no longer reflects unencoded arbitrary parameters.
3. If upgrading is not immediately possible, contact Trimble support and request an out-of-band hotfix or configuration-hardening guidance.

Long-term hardening:

1. Input validation/output encoding: Apply context-aware output encoding (HTML entity, attribute, JavaScript) on every reflection point in the application, especially on externally reachable endpoints.
2. Content-Security-Policy (CSP): Introduce a strict CSP with script-src 'self' to limit the impact of any future XSS.
3. HttpOnly and Secure cookie flags: Ensure session cookies are inaccessible to JavaScript.
4. Periodic security review: Conduct application-level penetration tests focused on untrusted-data reflection points in externally exposed functionality.
5. Track remediation status: Re-evaluate this CVE as new versions are released; test the exact endpoint described in the NVD entry against candidate fixes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-35499
2. CWE-79 (Cross-site Scripting) description: https://cwe.mitre.org/data/definitions/79.html
3. Trimble Product Security Page (monitor for future advisories): https://www.trimble.com/en/legal/product-security
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat-actor activity: No known threat campaigns have been attributed to this CVE, no exploit-in-the-wild evidence has been observed, and no public PoC code has been released. The vulnerability remains unpatched and therefore latent for potential future discovery and weaponization by threat actors targeting Trimble's transportation and logistics customer base.