OSIsoft PI Vision

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in PI Vision versions prior to 2021 [1]. An attacker with write access to PI Vision can inject arbitrary JavaScript code into a display. The vulnerability is triggered when a victim using Microsoft Internet Explorer views or interacts with the infected display [1].

Exploitation

To exploit, an attacker must have write access to PI Vision (e.g., Publisher or Explorer roles). The attacker injects malicious code into a display, which is then stored. When a victim with sufficient privileges views the display using Internet Explorer, the injected code executes in the context of the victim's session [1].

Impact

Successful exploitation can lead to unauthorized information disclosure, modification, or deletion of PI System data and other data accessible with the victim's user permissions. The impact is limited by the victim's privileges [1].

Mitigation

OSIsoft recommends upgrading to PI Vision 2021 (registration required for security bulletin). Workarounds include configuring Publisher and Explorer roles in PI Vision User Access Levels to restrict write access [1].