CVE-2022-35497: Trimble TM4WEB XSS Vulnerability

CVE-2022-35497 Overview

CVE-2022-35497 affects Trimble TM4WEB version 21.4.0.4. The vulnerability stems from insecure session identifier handling combined with a reflected cross-site scripting (XSS) flaw in the external document viewer endpoint. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser session. Because session cookies lack protective flags, the injected script can read and exfiltrate valid session identifiers. Successful exploitation allows session hijacking against authenticated TM4WEB users. A public proof-of-concept for CVE-2022-35497 exists on GitHub, increasing exposure for unpatched deployments.

Critical Impact
Reflected XSS combined with accessible session cookies enables full session hijacking of authenticated TM4WEB users through a single crafted link.

Affected Products

Trimble TM4WEB 21.4.0.4
External document viewer endpoint within TM4WEB
Deployments relying on default TM4WEB session cookie configuration

Discovery Timeline

2026-09-04 - CVE-2022-35497 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-35497

Vulnerability Analysis

CVE-2022-35497 combines two weaknesses into one exploitation chain. First, the external document viewer endpoint reflects attacker-controlled input into responses without proper output encoding. This allows arbitrary JavaScript to execute in the context of the TM4WEB origin. Second, session identifiers are exposed to client-side script because protective cookie attributes are not enforced. An attacker chains these issues by delivering a crafted link to an authenticated user, then harvesting the returned session token.

Root Cause

The root cause is a security misconfiguration around session identifiers paired with missing input sanitization on the external document viewer endpoint. Session cookies do not carry attributes that would prevent script access, so any XSS primitive within the application origin can retrieve them. The reflected XSS provides that primitive by returning user-supplied parameters directly into rendered HTML.

Attack Vector

Exploitation of CVE-2022-35497 requires user interaction. An attacker crafts a URL targeting the vulnerable external document viewer parameter and delivers it via phishing, chat, or an external site. When an authenticated TM4WEB user visits the link, the injected payload executes and reads the session cookie. The attacker receives the token through an out-of-band request and replays it to impersonate the victim.

A public proof-of-concept is available in the GitHub CVE-2022-35497 PoC repository. No authenticated code execution or elevated privileges are required to trigger the reflected XSS; the impact depends on the victim's session privileges.

Detection Methods for CVE-2022-35497

Indicators of Compromise

Web server logs containing requests to the external document viewer endpoint with <script>, onerror=, javascript:, or URL-encoded equivalents in query parameters
Outbound requests from user browsers to unknown domains immediately after visiting a TM4WEB document viewer URL
Concurrent TM4WEB sessions for the same account originating from distinct IP addresses or geolocations
Session cookie reuse across user-agent strings that do not match the original client

Detection Strategies

Deploy WAF or reverse-proxy rules that inspect query parameters sent to the TM4WEB document viewer endpoint for XSS signatures
Correlate authentication events with source IP changes on a fixed session identifier to surface hijacked sessions
Alert on referer headers pointing to external domains for sensitive TM4WEB endpoints handling document rendering

Monitoring Recommendations

Enable verbose access logging on TM4WEB and forward logs to a central analytics platform for query-parameter inspection
Monitor browser telemetry or endpoint agents for unexpected script execution originating from TM4WEB URLs
Track anomalous session lifetimes and repeated cookie replays across mismatched fingerprints

How to Mitigate CVE-2022-35497

Immediate Actions Required

Restrict access to the TM4WEB external document viewer endpoint to trusted networks until a fix is applied
Contact Trimble support to confirm a patched build for TM4WEB 21.4.0.4 and schedule an upgrade
Invalidate active TM4WEB sessions and require re-authentication to eliminate previously harvested tokens
Educate users to avoid clicking TM4WEB links from untrusted sources

Patch Information

No vendor advisory URL is published in the NVD record for CVE-2022-35497. Administrators should consult Trimble and the TM4Web product page for updated builds addressing the reflected XSS and session cookie misconfiguration.

Workarounds

Configure the web server or reverse proxy to add HttpOnly, Secure, and SameSite=Strict attributes to TM4WEB session cookies
Deploy a Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Add WAF signatures that drop requests containing script tags or event handlers in parameters to the document viewer endpoint
Shorten session lifetimes and bind sessions to client IP or device fingerprint where feasible

bash

# Example reverse-proxy hardening for TM4WEB session cookies (nginx)
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;