Hitachi Energy MSM jQuery XSS vulnerability
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
jQuery cross-site scripting flaw in Hitachi Energy MSM versions 2.2.9 and prior allows remote code execution with user interaction.
Hitachi Energy Modular Switchgear Monitoring (MSM) versions 2.2.9 and earlier contain a cross-site scripting (XSS) vulnerability stemming from an underlying jQuery flaw (CVE-2020-11022). The vulnerability exists in jQuery versions 1.2 through 3.4.x, where DOM manipulation methods such as .html() and .append() may execute untrusted code even after sanitization. A remote attacker can exploit this with low attack complexity and no privileges required, requiring only user interaction to trigger.
Successful exploitation could allow an attacker to execute arbitrary code in the context of the affected MSM system, potentially leading to unauthorized actions or complete system compromise. The vulnerability affects energy sector infrastructure worldwide. CISA reports no known public exploitation targeting this specific vulnerability at the time of advisory publication.
Defenders should apply available patches from Hitachi Energy PSIRT advisory 8DBD000219, isolate MSM systems from internet exposure, restrict network access via firewalls, and require VPN authentication for remote access. Organizations should perform impact analysis before deploying defensive measures.
Mentioned in this report
Detection guidance
Web Request with Script Tag or Event-Handler XSS Payload in Query String
Detects HTTP requests whose query string carries raw or URL-encoded script tags, inline event handlers or javascript: URIs, the typical reflected XSS delivery against a public-facing web application such as a jQuery-dependent monitoring UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Request with Script Tag or Event-Handler XSS Payload in Query String
status: experimental
description: Detects HTTP requests whose query string carries raw or URL-encoded script
tags, inline event handlers or javascript URIs. This is the typical reflected XSS
delivery against a public-facing web application, for example one that uses a vulnerable
jQuery version (CVE-2020-11022). Behavioural pattern only, not tied to any specific
application. Tune by scoping to the affected web servers.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection_raw:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
- <svg/onload
selection_encoded:
cs-uri-query|contains:
- '%3Cscript'
- '%3Csvg'
- '%3Cimg%20src'
- '%3Ciframe'
condition: 1 of selection_*
falsepositives:
- Authorised web vulnerability scanners or penetration tests against the application
- Applications that legitimately pass HTML snippets or javascript URIs in query parameters,
such as WYSIWYG editors or redirect parameters
level: medium
id: 8662ea17-01cc-5613-b075-f9b1327b79b5
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-07
jQuery HTML Sanitisation Bypass Pattern with Option and Style Tags in Request
Detects requests whose query string contains both option and style tags, the construct used to abuse jQuery .html()/.append() sanitisation bypass (CVE-2020-11022) for script execution in the victim browser. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: jQuery HTML Sanitisation Bypass Pattern with Option and Style Tags in Request
status: experimental
description: Detects requests whose query string contains both option and style markup,
raw or URL-encoded. This is the construct commonly used to abuse the jQuery .html()/.append()
sanitisation flaw (CVE-2020-11022, jQuery 1.2 to 3.4.x) to run attacker JavaScript
in the victim browser. Matches the technique pattern, not a specific payload.
tags:
- attack.execution
- attack.t1059.007
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_raw:
cs-uri-query|contains|all:
- <option
- <style
selection_encoded:
cs-uri-query|contains|all:
- '%3Coption'
- '%3Cstyle'
condition: 1 of selection_*
falsepositives:
- Security scanners replaying known jQuery XSS test payloads
- Applications that submit rich HTML form content through GET parameters
level: medium
id: 82fa3cfe-64b2-592e-a35c-97f00b19a2b9
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-07
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-07
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs