# Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

Reflected XSS in Siemens Teamcenter /auth/ login-redirect form attributes auto-fires via onformdata on programmatic submit, letting an attacker silently add a surrogate delegate to the victim's account.

- Payout: Research
- Severity: high
- Program: Siemens Teamcenter
- Disclosed: 2026-10-13
- CVE: CVE-2026-58113
- Write-up quality: 8/10
- Original: https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-xss-siemens-teamcenters-login-redirect-cve-2026-58113
- Tags: area:web domain:web impact:integrity impact:privesc kind:research platform:research sev:high tech:rest technique:source-review vuln:xss

**Target:** Teamcenter Active Workspace /auth/ SSO login-redirect endpoint
**Root cause:** The /auth/ redirect page reflects arbitrary query parameter names and values into HTML form attributes without contextual encoding, and the page auto-submits the form on load, firing injected event handlers without user interaction.
**Steps:**
1. Craft a request to `/auth/?locale=en_US&correlationId=<id>&operationId=awLogin/1&sessionId=<id>&poc%22+onformdata=confirm(%27Teamcenter_XSS%27)+x=%221`
2. The `%22` closes the form action attribute; `onformdata=...` becomes a new attribute on the `<form>`; `x="1` rebalances markup
3. Victim (authenticated) opens the link; page loads and `onLoad` calls `updateURL()`
4. `updateURL()` calls `document.getElementById('autoSubmit').submit()`, which builds the entry list and fires the `formdata` event
5. Injected `onformdata` handler executes in the Teamcenter origin before navigation to SSO
6. Replace confirm() with a fetch POST to `/tc/RestServices/Workflow-2014-06-Workflow/setSurrogate` using `credentials:'include'`, `keepalive:true`, and `X-Xsrf-Token` read from `document.cookie`
7. Server creates a surrogate delegation from victim to attacker-controlled account
**How found:** While mapping the authentication flow during an authorized pentest of Active Workspace, noticed /auth/ reflected several request parameters and arbitrary parameter names into form attributes unencoded; then observed the page programmatically submits the form on load, turning attribute injection into zero-interaction execution.
**Exploitation:** Attacker sends a crafted /auth/ URL to an authenticated Teamcenter user (e.g. phishing). On load the page auto-submits its SSO redirect form, firing the injected onformdata handler, which issues an authenticated POST to the setSurrogate workflow API with the victim's session cookies and the double-submit XSRF token read from document.cookie. keepalive:true lets the request survive the imminent navigation. Result: a surrogate delegation is created letting the attacker's account act on behalf of the victim across permitted workflows.
**Escalation:** Chained reflected XSS into a state-changing API call (setSurrogate) to convert code execution into persistent delegated authority over the victim's PLM permissions; broader APIs (data exfiltration, record tampering, approval of change orders) reachable within victim's authorization.
**Insight:** When a page auto-submits a form built from request data, attribute-context injection becomes zero-click: look for handlers that fire during programmatic submit (onformdata fires on entry-list construction) rather than the usual onmouseover/onclick. Also, double-submit CSRF tokens readable from document.cookie are trivially echoed by any XSS in the origin.

## Proof of concept (copied exactly from the original report)

**Reflected XSS payload breaking out of form action**

```
&poc%22+onformdata=confirm(%27Teamcenter_XSS%27)+x=%221
```