AVEVA PI Web API stored XSS via annotation attachments
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authenticated users can inject persistent JavaScript in AVEVA PI Web API annotations; requires CSP bypass and social engineering.
A cross-site scripting vulnerability (CVE-2025-2745, CVSS 4.5) exists in AVEVA PI Web API versions 2023 SP1 and earlier. An authenticated attacker with privileges to create or update annotations or upload media files can inject arbitrary JavaScript that persists and executes when other users view annotation attachments in a web browser—but only if those users disable content security policy protections. The attack requires social engineering to lower browser defenses and user interaction to render the malicious annotation. HAVIA reports no known public exploitation of this specific vulnerability to date.
Mitigation requires updating to PI Web API 2023 SP1 Patch 1 or later. Defenders should restrict file extensions on annotation attachments (particularly SVG and PDF), implement organizational policies to prevent CSP disabling, use direct REST API calls for attachments rather than in-browser rendering, and audit "Annotate" access rights to trusted users only. CISA recommends standard ICS hardening: network isolation, firewall segmentation, VPN for remote access, and user awareness of social engineering tactics.
Mentioned in this report
Detection guidance
PI Web API Annotation Attachment Upload With Script-Capable Content Type
Write request to a PI Web API annotation or attachment/media endpoint carrying SVG, HTML or XML content, the stored-XSS injection step for CVE-2025-2745. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PI Web API Annotation Attachment Upload With Script-Capable Content Type
id: 706fb12f-2c71-5bf3-8f77-816f1009086a
status: experimental
description: Detects write requests (POST/PUT/PATCH) to AVEVA PI Web API annotation
or attachment/media endpoints where the content type is SVG, HTML or XML. These
types can carry embedded JavaScript, which is how stored XSS is planted for CVE-2025-2745.
Endpoint paths are generalised and should be tuned to the local PI Web API URL layout.
tags:
- attack.execution
- attack.t1059.007
- attack.initial-access
- attack.t1189
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains|all:
- /piwebapi/
- annotation
selection_method:
cs-method:
- POST
- PUT
- PATCH
selection_type:
cs-content-type|contains:
- image/svg
- text/html
- application/xhtml
- text/xml
- application/xml
selection_ext:
cs-uri-stem|endswith:
- .svg
- .html
- .htm
- .xhtml
condition: selection_endpoint and selection_method and 1 of selection_type or selection_ext
and selection_endpoint and selection_method
falsepositives:
- Legitimate users attaching SVG diagrams or HTML reports to annotations
- Integrations that post XML-formatted annotation payloads to PI Web API
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08
PI Web API Annotation Attachment Served As Active Content
PI Web API annotation attachment or media GET returning SVG or HTML content that a browser may render and execute when CSP is disabled. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PI Web API Annotation Attachment Served As Active Content
id: 0606dcf1-5231-5a30-abef-97c6c43790ff
status: experimental
description: Detects GET requests to PI Web API annotation attachment or media endpoints
where the response content type is SVG or HTML. Rendering these in a browser with
CSP disabled executes stored JavaScript (CVE-2025-2745). Useful for finding victims
who viewed a malicious attachment; tune the path match to the local deployment.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-stem|contains|all:
- /piwebapi/
- annotation
sc-content-type|contains:
- image/svg
- text/html
- application/xhtml
condition: selection
falsepositives:
- Users legitimately viewing SVG or HTML attachments on annotations
- PI Web API help or documentation pages that return HTML under a matching path
level: low
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs