{"id":24793,"date":"2026-01-19T16:30:00","date_gmt":"2026-01-19T15:30:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=24793"},"modified":"2026-01-22T14:58:37","modified_gmt":"2026-01-22T13:58:37","slug":"usd-2025-0039","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0039\/","title":{"rendered":"usd-2025-0039"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.5\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2025-39 | PRTG Network Monitor 25.2.108 - Reflected XSS<\/h1>\n

<\/h1>\n

Product<\/strong>: PRTG Network Monitor
Affected Version<\/strong>: <25.2.108
Vulnerability Type<\/strong>: Cross-Site Scripting (CWE-79)
Security Risk<\/strong>: Medium
Vendor<\/strong>: Paessler
Vendor URL<\/strong>: https:\/\/www.paessler.com\/de<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2025-67834
CVE Link<\/strong>: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-67834<\/a>
Advisory ID<\/strong>: usd-2025-39<\/p>\n

Description<\/h3>\n

The application does not properly encode or filter user-supplied data, which allows reflective injection of JavaScript code.<\/p>\n

This occurs when the web server embeds input containing JavaScript into HTTP responses without sufficient encoding.
The input is not persistently stored but only temporarily reflected and executed within the browsing context of the user.
To perform a reflected XSS attack, an attacker has to induce the victim to issue a malicious request, for example by providing a prepared link.<\/p>\n

A reflected XSS vulnerability can be exploited in various ways.
A common attack is to steal sensitive information from the user and secretly transmit it to the attackers.
Alternatively, attackers can perform actions with the permissions of the user.<\/p>\n

Proof of Concept<\/h3>\n

The search for sensors with a specific tag is vulnerable for reflected cross-site scripting (XSS) attacks, allowing users to inject malicious JavaScript code into the website.<\/p>\n

This vulnerability could be exploited by inducing administrators to click on malicious links to craft malicious links that, if the payload is successfully triggered, could lead to attackers stealing the administrator''s session cookie or performing administrative actions.
Attackers could utilize techniques such as phishing to persuade a user to click on a malicious link.<\/p>\n

Obtaining a user's session cookie however is only possible if the cookie's HttpOnly flag is not set.<\/p>\n

The following link shows an example of malicious link that exploits this vulnerability.
In this case, the payload <\/strong><\/p>\n

alert(document.domain)<\/strong><\/p>\n

is inserted into the website, which opens a popup with the user's session cookie.<\/p>\n

\n
<\/span>[<\/span>https:\/\/[REDACTED<\/span>]\/<\/span>sensors<\/span>.<\/span>htm<\/span>?<\/span>filter_tags<\/span>=<\/span>@tag<\/span>(<\/span>%<\/span>3<\/span>Cscript<\/span>%<\/span>3<\/span>Ealert<\/span>(<\/span>document<\/span>.<\/span>cookie<\/span>)<\/span>%<\/span>3<\/span>C<\/span>\/<\/span>script<\/span>%<\/span>3<\/span>E<\/span>)<\/span>]<\/span>()<\/span><\/pre>\n<\/div>\n
The following screenshot shows how the injected JavaScript code opens a popup.<\/p>\n
\"\"<\/p>\n
Fix<\/h3>\n
It is recommended to treat all input on the website as potentially dangerous.<\/p>\n
Invalid values should not be sanitized and forwarded to the application, but instead rejected.
To achieve this, all input should be validated on the server-side.
Where possible, a list of allowed characters should be defined.
The more restrictive a filter can be specified, the better the protection it provides.
Allowlists are especially recommended if input values have a well defined format or a list of valid input values exists.<\/p>\n
Additionally, all output that is dynamically generated based on user-controlled data should be encoded according to its context.
The majority of programming languages support standard procedures for encoding meta characters.<\/p>\n
Further details on how to prevent XSS vulnerabilities can be obtained in the XSS Prevention Cheat Sheet by OWASP.<\/p>\n
References<\/h3>\n