← Back to all briefings
Infrastructure 5 min read Published Updated Credibility 45/100

Infrastructure Briefing — OSIsoft PI Web API XSS mitigations for OT historians

CISA warns that PI Web API 2019 instances can be coerced into executing arbitrary JavaScript through crafted requests, risking unauthorized data view or tampering on OT historians.

Zeph Tech Research Lead

Research lead, Zeph Tech

Infrastructure pillar illustration for Zeph Tech briefings
Infrastructure supply chain and reliability briefings

Executive briefing: CISA’s ICSA-20-163-01 advisory details a cross-site scripting flaw in OSIsoft’s PI Web API 2019. The weakness allows a remote authenticated attacker to trick a PI user into executing attacker-supplied JavaScript, potentially leading to unauthorized viewing, modification, or deletion of historian data.

Immediate actions for PI administrators

  • Patch to PI Web API 2019 SP1. OSIsoft’s fix elevates input validation and should be deployed on all internet-facing and internal PI Web API nodes.
  • Constrain write-capable accounts. Limit which users and service principals have write permissions to PI Servers exposed through PI Web API endpoints; prefer dedicated service accounts with scoped privileges.
  • Harden exposure. Keep PI Web API off the open internet, enforce HTTPS with modern ciphers, and front-end the service with reverse proxies or VPNs to filter unexpected requests.

Strategic follow-through

  • Review historian integrations. Validate upstream applications that call PI Web API to ensure they cannot be abused as cross-site scripting pivots.
  • Detection engineering. Add logging and alerts for unusual POST/PUT requests to PI Web API endpoints, especially those originating from user workstations instead of application servers.
  • Governance. Document PI Web API surface area in asset inventories and ensure quarterly patch windows include the service.

Source excerpts

Primary — impact: “Successful exploitation of this vulnerability could allow a remote authenticated attacker with write access to a PI Server to trick a user into interacting with a PI Web API endpoint that executes arbitrary JavaScript in the user’s browser, resulting in view, modification, or deletion of data as allowed for by the victim’s user permissions.”

CISA ICSA-20-163-01 (OSIsoft PI Web API 2019)

Primary — vendor fix: “OSIsoft recommends affected users upgrade to PI Web API 2019 SP1.”

CISA ICSA-20-163-01 (OSIsoft PI Web API 2019)

Operational monitoring

Operations teams should enhance monitoring and observability for infrastructure changes:

  • Metrics collection: Identify key performance indicators and operational metrics exposed by this component. Configure collection pipelines and retention policies appropriate for capacity planning and troubleshooting needs.
  • Alerting thresholds: Establish alerting rules that balance sensitivity with noise reduction. Start with conservative thresholds and tune based on operational experience to minimize false positives.
  • Dashboard updates: Create or update operational dashboards to provide visibility into component health, resource utilization, and dependency status. Ensure dashboards support both real-time monitoring and historical analysis.
  • Log aggregation: Configure log shipping, parsing, and indexing for relevant log streams. Define retention policies and implement log-based alerting for critical error conditions.
  • Distributed tracing: If applicable, integrate with distributed tracing systems to enable end-to-end request visibility and performance analysis across service boundaries.

Document monitoring configuration in version-controlled infrastructure-as-code to ensure reproducibility and facilitate disaster recovery scenarios.

Cost and resource management

Infrastructure teams should evaluate cost implications and optimize resource utilization:

  • Cost analysis: Assess the cost impact of infrastructure changes, including compute, storage, networking, and licensing. Model costs under different scaling scenarios and traffic patterns.
  • Resource optimization: Right-size resources based on actual utilization data. Implement auto-scaling policies that balance performance requirements with cost efficiency.
  • Reserved capacity planning: Evaluate opportunities for reserved instances, savings plans, or committed use discounts. Balance reservation commitments against flexibility requirements.
  • Cost allocation: Implement tagging strategies and cost allocation mechanisms to attribute expenses to appropriate business units or projects. Enable chargeback or showback reporting.
  • Budget management: Establish budget thresholds and alerting for infrastructure spending. Implement governance controls to prevent cost overruns from unauthorized provisioning.

Regular cost reviews help identify optimization opportunities and ensure infrastructure investments deliver appropriate business value.

Security and compliance

Infrastructure security teams should assess and address security implications of this change:

  • Network security: Review network segmentation, firewall rules, and access controls. Ensure traffic patterns align with security policies and zero-trust principles.
  • Identity and access: Evaluate authentication and authorization mechanisms for infrastructure components. Implement least-privilege access and rotate credentials regularly.
  • Encryption standards: Ensure data encryption at rest and in transit meets organizational and regulatory requirements. Manage encryption keys through appropriate key management services.
  • Compliance controls: Verify that infrastructure configurations align with relevant compliance frameworks (SOC 2, PCI-DSS, HIPAA). Document control implementations for audit evidence.
  • Vulnerability management: Integrate vulnerability scanning into deployment pipelines. Establish patching schedules and remediation SLAs for infrastructure components.

Security considerations should be integrated throughout the infrastructure lifecycle, from initial design through ongoing operations.

  • Recovery objectives: Define and validate Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for affected systems. Ensure objectives align with business continuity requirements.
  • Backup strategies: Review backup configurations, schedules, and retention policies. Validate backup integrity through regular restoration tests and document recovery procedures.
  • Failover mechanisms: Test failover procedures for critical components. Ensure automated failover is properly configured and manual procedures are documented for scenarios requiring intervention.
  • Geographic redundancy: Evaluate multi-region or multi-datacenter deployment requirements. Implement data replication and synchronization appropriate for recovery objectives.
  • DR testing: Schedule regular disaster recovery exercises to validate procedures and identify gaps. Document lessons learned and update runbooks based on test results.

Disaster recovery preparedness is essential for maintaining business continuity and meeting organizational resilience requirements.

Related briefings

Curated signals from the same pillar or overlapping topics.

Continue in the Infrastructure pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • OSIsoft
  • PI System
  • XSS
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.