Stored XSS in Forcepoint Web Security Transaction Viewer can act through an administrator's browser

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.

• Forcepoint Web Security, Transaction Viewer: affected from version 0 through versions less than 8.5.6; the default status is affected.
• The record does not enumerate separate parallel release branches or deployment types, so status outside this boundary is not independently established.

Forcepoint Web Security Transaction Viewer processes the user agent field in reports about requests sent through the web proxy. The field contains a persistent Cross-Site Scripting weakness because input is not properly neutralized before being included in web content. The record states that any user able to route traffic through the Forcepoint Web proxy may place data in this field without having administrator privileges. When the stored content is rendered in an administrator's browser, JavaScript may execute in that browser context and potentially perform actions with the administrator's authority. The supplied attack characteristics indicate network reachability, no required privileges, low attack complexity, and required user interaction, while the exact trigger is not documented. The record does not disclose the precise encoding, filtering, HTML context, or conditions required for malicious content to be rendered.

• The vulnerability is reachable over the network by a user who can route traffic through the Forcepoint Web proxy.
• The supplied record indicates that no prior privileges are required and that attack complexity is low.
• User interaction is required. For this stored XSS, the likely condition is that a Forcepoint administrator opens or views Transaction Viewer content containing the stored data.
• The record does not confirm real-world exploitation and does not identify a public exploit, campaign, or specific victim.

The technical outcome is execution of attacker-controlled JavaScript in a Forcepoint administrator's browser context. This can move the impact from user-supplied report data to administrative functions and allow unauthorized actions with the authority of that session. Potential consequences include loss of data confidentiality or integrity and, where available administrative functions permit it, disruption of service or configuration. The actual scope depends on administrator permissions and additional controls; the record does not confirm a specific exploitation event.

• An attacker may perform actions with the authority of an administrator's browser session if the JavaScript executes successfully.
• Potential consequences include unauthorized access to administrative information or changes to data and configuration available to that administrator.
• Actual business impact depends on the administrator's permissions, session protections, and the functions exposed by the portal.
• The record does not identify a specific breach, victim, or affected organization.

1. Upgrade Forcepoint Web Security to version 8.5.6.
2. If the deployment is on version 8.5.5 and cannot yet be upgraded, apply the workaround steps provided by Forcepoint for that version.
3. While awaiting the upgrade or workaround, restrict use of Transaction Viewer in a manner that avoids adding the user agent field to reports if this measure is confirmed by Forcepoint's handling guidance.
4. After remediation, verify the version on each system and confirm that the Transaction Viewer workflow no longer renders unneutralized user-agent data.

1. Inventory Forcepoint Web Security deployments and identify systems that provide or enable Transaction Viewer.
2. Check the deployed version on each system and determine which installations remain within the affected boundary.
3. Review whether Transaction Viewer reports display the user agent field, especially in administrator sessions.
4. Review user-agent data and generated reports for unexpected markup or script-like strings. This is a precautionary review, not a confirmed indicator of compromise.
5. Examine browser or administrative-session telemetry for unusual actions after an administrator views a report. The absence of such evidence does not prove that the system is safe.