CVE-2022-35499: Trimble TM4WEB Reflected XSS Vulnerability

CVE-2022-35499 Overview

CVE-2022-35499 is a reflected cross-site scripting (XSS) vulnerability in Trimble TM4WEB version 21.4.0.4. The flaw resides in the external bill viewer endpoint, which fails to sanitize arbitrary URL parameters before reflecting them in server responses. An attacker can craft a malicious URL that, when opened by an authenticated user, executes attacker-controlled JavaScript in the victim's browser session. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in the victim's browser context, enabling session hijacking, credential theft, and unauthorized actions on the TM4WEB application.

Affected Products

Trimble TM4WEB 21.4.0.4
External bill viewer endpoint component
Web-facing deployments accessible to authenticated users

Discovery Timeline

2026-09-04 - CVE-2022-35499 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-35499

Vulnerability Analysis

The vulnerability exists in the external bill viewer endpoint of Trimble TM4WEB 21.4.0.4. The endpoint reflects arbitrary URL query parameters into the rendered HTML response without applying proper output encoding or input sanitization. This behavior enables a reflected XSS attack where an attacker delivers a crafted link to a target user. When the target opens the URL, the injected payload runs in the browser under the origin of the TM4WEB application. Attackers can leverage this to steal session cookies, hijack authenticated sessions, perform actions on behalf of the user, or pivot to further attacks against internal systems.

Root Cause

The root cause is missing output encoding of user-controlled input in the external bill viewer response path. Any arbitrary parameter appended to the URL is echoed back into the HTML response, allowing HTML and JavaScript injection. This aligns with [CWE-79], improper neutralization of input during web page generation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting the external bill viewer endpoint with an injected script payload in an arbitrary query parameter. The attacker then delivers the URL through phishing, chat, or a malicious web page. When a user with an active TM4WEB session clicks the link, the payload executes in their browser. Because the scope changes to the user's authenticated context, the attacker can read or modify data available to that user.

No verified exploit code is published in official advisories. A public proof-of-concept is available in the GitHub PoC for CVE-2022-35499 repository.

Detection Methods for CVE-2022-35499

Indicators of Compromise

Web server or application logs containing requests to the external bill viewer endpoint with query parameters containing <script>, onerror=, onload=, javascript:, or URL-encoded equivalents (%3Cscript%3E).
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting a TM4WEB URL.
Anomalous session activity, such as session token reuse from unexpected IP addresses following a click on an external link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings sent to the TM4WEB bill viewer endpoint for common XSS payload signatures.
Enable verbose HTTP request logging on the TM4WEB server and alert on query parameter values containing HTML or JavaScript syntax.
Correlate reverse-proxy access logs with endpoint browser telemetry to identify script execution originating from reflected requests.

Monitoring Recommendations

Monitor referrer headers and click paths that lead users to the TM4WEB bill viewer with unusual URL structures.
Track user-agent and geolocation anomalies on authenticated TM4WEB sessions to catch post-exploitation session reuse.
Alert on Content Security Policy (CSP) violation reports if CSP is enabled on the TM4WEB origin.

How to Mitigate CVE-2022-35499

Immediate Actions Required

Contact Trimble support to obtain guidance on patched versions or hotfixes for TM4WEB 21.4.0.4.
Restrict access to the external bill viewer endpoint through network segmentation or VPN until a fix is applied.
Educate users about the risk of clicking unsolicited TM4WEB links delivered via email or messaging platforms.

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Administrators should consult the Trimble Official Site and the TM4Web Homepage for updated versions and vendor advisories addressing CVE-2022-35499.

Workarounds

Deploy a WAF rule that blocks requests to the external bill viewer endpoint containing HTML control characters (<, >, ", ') or script-related keywords in query parameters.
Enforce a strict Content Security Policy on the TM4WEB origin to disallow inline scripts and restrict script sources.
Configure session cookies with HttpOnly and Secure attributes and enable SameSite=Strict to limit exposure from XSS-based session theft.

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads
SecRule REQUEST_URI "@contains /billviewer" \
  "chain,id:1002235499,phase:2,deny,status:403,msg:'Blocked potential XSS on TM4WEB bill viewer (CVE-2022-35499)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "t:none,t:urlDecodeUni"