CVE-2025-1359: SIAM 2.0 Cross-Site Scripting Vulnerability

CVE-2025-1359 Overview

CVE-2025-1359 is a reflected cross-site scripting (XSS) vulnerability affecting SIAM Industria de Automação e Monitoramento SIAM 2.0. The flaw resides in the /qrcode.jsp endpoint, where the url parameter is not properly sanitized before being reflected into the response. Attackers can inject arbitrary JavaScript that executes in the context of a victim's browser session. The issue is remotely exploitable and requires user interaction, such as clicking a crafted link. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser to steal session data, perform actions on behalf of the user, or redirect to malicious content.

Affected Products

SIAM Industria de Automação e Monitoramento SIAM 2.0
Component: /qrcode.jsp
Vulnerable parameter: url

Discovery Timeline

2025-02-16 - CVE-2025-1359 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1359

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw [CWE-79] in the SIAM 2.0 web application. The /qrcode.jsp handler accepts a url argument from the query string and includes its value in the generated HTML response without adequate output encoding or input validation. When an attacker crafts a URL containing malicious JavaScript in the url parameter and lures a user to visit it, the payload executes within the origin of the SIAM application. This grants the attacker access to cookies, session tokens, and any client-side actions available to the authenticated user. Because SIAM is used for industrial automation and monitoring, hijacked sessions can expose operational data and control interfaces.

Root Cause

The root cause is missing sanitization and contextual output encoding of the url request parameter in /qrcode.jsp. The application reflects untrusted input directly into the rendered page, violating standard input validation and output encoding practices for web applications.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL such as https://<siam-host>/qrcode.jsp?url=<payload> where the payload contains HTML or JavaScript. The victim clicks the link, typically delivered via phishing or a malicious referrer, and the injected script runs in their browser session. No authentication is needed to trigger the reflected payload, though the impact escalates against authenticated SIAM users.

No verified proof-of-concept code has been released beyond references in the VulDB entries. See the VulDB advisory #295967 for additional technical context.

Detection Methods for CVE-2025-1359

Indicators of Compromise

Web server access logs showing requests to /qrcode.jsp with url parameter values containing <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers from external phishing domains pointing users to SIAM /qrcode.jsp endpoints.
Unexpected outbound requests from user browsers to attacker-controlled hosts following visits to /qrcode.jsp.

Detection Strategies

Deploy web application firewall (WAF) rules to inspect the url query parameter for HTML tags, event handlers, and script schemes.
Enable server-side request logging on the SIAM application and alert on anomalous character sequences in query strings for /qrcode.jsp.
Correlate authentication events with suspicious /qrcode.jsp requests to identify potential session compromise following XSS execution.

Monitoring Recommendations

Continuously monitor HTTP traffic to SIAM endpoints for encoded XSS payloads and repeated probing from single sources.
Track browser-side Content Security Policy (CSP) violation reports if a CSP is deployed on the SIAM host.
Review session activity for accounts that visited crafted /qrcode.jsp URLs and reset credentials if anomalies are observed.

How to Mitigate CVE-2025-1359

Immediate Actions Required

Restrict access to the SIAM 2.0 web interface to trusted networks using firewall rules or VPN gating until a fix is available.
Deploy WAF signatures that block requests to /qrcode.jsp when the url parameter contains script tags, event handlers, or JavaScript URI schemes.
Warn SIAM users against clicking unsolicited links referencing the SIAM host, especially those containing long or encoded url query strings.

Patch Information

No vendor patch is available. The disclosure notes that SIAM Industria de Automação e Monitoramento was contacted prior to publication but did not respond. Organizations should track the VulDB entry for updates and contact the vendor directly for remediation guidance.

Workarounds

Place SIAM behind a reverse proxy that strips or sanitizes the url parameter on requests to /qrcode.jsp.
Enforce a strict Content Security Policy on the SIAM application host to prevent inline script execution and unauthorized script sources.
Set the HttpOnly and Secure flags on SIAM session cookies to limit the impact of XSS-based session theft.
Disable or block external access to /qrcode.jsp if the QR code functionality is not required for operations.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on /qrcode.jsp
SecRule REQUEST_URI "@beginsWith /qrcode.jsp" \
    "chain,phase:2,deny,status:403,id:1002025,\
    msg:'CVE-2025-1359 SIAM qrcode.jsp XSS attempt'"
    SecRule ARGS:url "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
        "t:none,t:urlDecodeUni"