安全研究
CVE-2025-0133 GlobalProtect 网关反射型 XSS：VPN 门户的凭据窃取
Thinking
2025-02-15
1 分钟阅读
研究档案
#漏洞分析#代码审计#网络攻击
Palo Alto GlobalProtect VPN 网关的登录页面未过滤用户输入，攻击者通过恶意 URL 注入 JavaScript 窃取用户凭据。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9227685ce892978cabe69246adda4055e52d9370edcae354491b7f37cf6929ee962205db672c4878650901a287052a347d9100af867d81d6bc4da0a60d59234d867b192fed444ec6e612f4f0ce32b69f5d9b9296b3514aecb76beb93bf6042a00b210fc2977fb75fedf92d5422c4648d00c2f448629d5dfb111f6b0403e25a0da0b3712d0857bf2004227fb1a92020a2a6a108437240f5da887939263bb414810823821e2c7cc2eb749c85f2f3ad5adb8410b849f894d05bd7f457991e64b0f41d1aa9b54d75b49fe23abdd7430da405526fc6ddd018af69c7c7d8d698c8821044bf1bf7c0fad145ccc4d9862de08e41007c6f622fb68d5615740410f24751e66b4abc4630fdf89114b2aedce7b114ed82560ff87a34c1c6bce47d48360b1befda21c6ac9fe490d17dd20f588613810f79fc980361acb34360fc7e14b2ecc32fcc2b9495d3cf0d8e9277a5145f5ffa2b589fb54535587fb3fff204b78a8bdd49feab44e207010bb10a70d9bba2a5fb8a4d86a62dc53224e92fb061ebd89a169560d5bb8d7c2d1b8d8a6018e218817664bd803e0a3342b3ff2e68bb5b484486076c16c54cae6fe67955f8ae65aca5090eb9653958c05742a42d690ebda98575b62ca51f520c1fe4ade9e12941ff68a1d327daa6cbdff952d2e74b277a5e9a1050731a13908c4194960fd0d1c5c739c9853a5317c366b1719763c6b13f2dd9562c9ac4533b0783ce169dead8fa60d90ca57882ffb5f85fa86b7679c9f82d543edb2500a084c99777a135be478230e8fb347d6e421fb3414bff33816b6446b7ec9c954e8e7f390f4351b4769d7b651c9a5842ba7c4f8d26b70e2ead17f98c00402aee9c01906eebae0a114ce6e8dcebe2c6f842dd174d2ef14b9b70bfe6fc34d231455feccf1dba421a3421d2780d8c29f0cfecf63395c3e9811017d78ef8dc01215725719c912052e410a7a53fb95e59949670111936a3584d7db57ca9b727ec685f3408dfbac2f0eaf4301a9352c71f33503dc2bedd7b6f4b9e14104d4bedb763bf9b55b77cf94875876a12580949a52b08ed84a277fee3f9b0c91f1a7f42387ed76375d893c450fd1fc491ca0dcc85a7b39a9822439747aa8f11088c56ebf4f5d7133408878c1fb4040dfd6d286150cd0fe4f15181516277c522171d6f0cb10365846b7c7124b2f177bb1c3864e01577141925cd01445a7a44745b33cca1f6be0a3568ddd158d017f73286ae088f4292033db6505a38a5fb6109abf11df7fe6a4dc8ac8c7f85304fdd929be6288fdacdcc11d0b199e83e2559b6cd1c81ae404a94b016b4e1db7e38e79be3847cd342d536eac90995d3f50b86363e900db54c97d45ab136e0628b4964b7ab78a25f784c0a58df89c47aa7914b61f9684ee241db4d15565097e3067de89c66d22c5151dfeb17816e7eeea01ad7ded2e27abfb0631906b353d8223157debc1e04c13d89114debb553810b7cf1b4e926c9a0d69b9c02116f7aa59e92ce783a4f278c1d3bf3c151a30338ad374a7b38f714966600048c912d308ac9452918ede7c4626fc211840da1a64e2220caaf848cfcb0eaf6bc1c5c32f4d49955d5f401d3bd5c076b4fa99a28855bd5d64dc6ef05ea829305144ee789a271c2b5cb4903ec027df574bb97eda7dff3389e98d5570d6a6abe7cddbfe49eeab42e46bbc3cff3b17b9aae9676a1271bbbc88e4e436ab98ee7f30fa3c56d2911a560b6022395114031a91143676e0cf6c18c9cdb03417249556c1985446ad5bd50f7ef31ea4f16bd231565046d6e7cf0fe3745c441f6e4463caec0d297fbb0227147762f0b8f92e602c6469941ed9315dbc4df1bc09105700b02390d9da568d94366d829bdb832454a36c9a96d6deb8388ae853f05140ba9b24435d30fa15442a8f523c0b9f03ab7edf5c776fc83025ae8cc0fd0c94d300031ef6f9d1a8e19a798431d6225b838a0e74dd4d242f8d66644bb8337c4ac414017f0cbeda167006b1c78291c5c8a1ea7017939e8d90657259c14e7c534938880e7f8ddd503da82e73633597455a445bd2650d05ecd08f5fe6c11946d0b5e593c1c714f1fb844be50a974379cf5ae0d3dd680bea02a3dc7a48563b39bf04f6a5d73ab895903080c2ef02cb92b24eadce2d156413fefa047ddacde2a68b07a44a94d998bed0759ca82b1d356bff29ed84fd3f81ae5b5208795142e37be3f56d1fa8f67c00f1c8c2e706037100854bac8a3166723d7f668abf733fada22ef4ef3c88792e533552a050bef862aa109336a2eb812ea077c6b4231832310b90d56e24ceb4ed318989a2017cbda2c7ea660632b054a8cc95c21df5fcec8356954b2b7de0670067e4f64c591b6843d7ae80b3866a8cc762d73e839b9906c634b777010f987aa1977d2547dec5cc7aed565a7e7b2bbb4797793c54d87613505fa508c5e49be27d03298706ce88cb20c0d7e10cd5985ee863f7bb469790a4152b3f6653c6a0d23ef023b6e2677504e06ddf27eb9889e736a4560a06821e26eaf41e182a8bf77201d3e1c0d1cb484723f219895f77c433cadedaa2bf36553a37fc3f422f49e1c762126e91de1e4aec5ea1d945603ca99f0f0669693d379d69e1bbfcaa8cb00759fa2c8466b734b49b32d11c25dd4151002966e5d4242eefe77236c99ab1a66ca8b7f5a0292ef4a0cc232d717e51c9ca48d970bd30c21570f53fcdaee49df961cfd66937b85775fab1654b4edb245850a73165f3e5f9825ec1a826d41dcf2c1be4a2c633e4abb4ba80131d83702b6bb40c616cf097ddc37163869e5e11f0afd65b83c28c1ea15dc7419730659537aeb921bcccb55a92510a61b03a9b500b82371d8b8da120881782498d7fae402a860e4ddce009c993a55468f250c0f943938f6c38a3686707fc877924378aa3fc687509e80fe0f2a4a61d993f1e3d0a163ca7bb81fd3e540c54c15f78b87302a873035f9dffa710ffb77642b65bf6f9c49f94cc94ae97f60f797db43f24d380ba44a57fd265f5844e04f91e7e14179be6ecd1d805aaecd2342828eeb2024da517820d0e7c8201ea46898503559d99512048c4b010d36aead88f4acaa1fbbbca633c1fbfc3544f0af0db64e239c088a9de05f90da940fcc8af801f42c9c55029ea848c1657138cc05131f3b752baec82e74546315a90c3dd9f7daef8ec6d5a4fba897ed7e4aa9345fd11dcf9d0f3950dc024a3bc12488bb862039b3f6c2611b76918fff5c22f8b31f870afd3a2212fcc0f0250d7c1064becce94c803271301c217819b1c05eb09fa23406f0a66cdd10a7463414d287a4bb011369bb50013b4273023c5525f459cf09af2a29d8ec4b1706d219e32d4be91098741214af8336b410d4fa2f8f6b4e803a656dc8bb365a1f0fd28e93331ccd67b46f7e597513ece21fcee8647b11b958d0bd417b0748844affa2a0376c5d5f5f03d6420860af3fdbb0b851de6e9c55b196f3e825642ee53b17a30c9d37e8d6b25366aaefa00724ad0c5b5c2650b1c1af15418ec6f2276684d51a60a8fd5ab5ea5c11ecd4c01b034167e06a761bdfe12c9a91848d8b8d0e991d718d78106ec9435a9607b11dba5fb15e21e72def95d7085f2d54f560a52a2badbf517bac3e085f5049917fe294f352f8f98b6f71e31ffd4fdb452dad89fc7dd4deea0df83e694dd75f64cca2e5911e0fc9b7b5b017a32e405473e642fec07de5228774ffcfd7c18817c822bc11b2ebe3ab01af99ea3bc969d5a692e83fa11e1c37079f2edb68750ac7129dac59e6fab32dd96a9f334d271d31e9eb14798ce7e414e2c7b6d02ea0e9e1ca3691500aa28df8189d2cab4677c9a31dc683195fdd35af7561bf8d7a03769c4d245590f8817272ee2240b3d4f6c996cda8d945f8acd815b9d4dc2a36854b675fc5492b6ee5df876227b0b87a3546828e5d7b0480f2a0526637c3cfb9dd4462a23e21fc97177bb9250b82913539b8004a0b277dbd6ea713408722c4fad096b3f0c8fa577b1ae94dee801815471923c61b26bfe19fb68b578411f2f86b09aaa315e439c6c478cf01c8ce25bc990e66dd94561cebb2418470d2d568ed98b5896dbb4dced0a8dd1df11b6ffd507cd6618f6e6b0f4d48e94b3bf35a4a6bab22ee9a11748ce7678eff00132eb076d5d1f24c71406b272adf505cb0dcd85a034fcbd57ff65e64706d15adb961a8fb69d7cafa0bcf5ad9fa37e15c1144574c337412b3941359a4b444a0dfc9e9553073ace9fa62d0ecd8960ff6bbd228f9056198a48d6ac35f7818f8498e6f96d85186f8be74f9551a5dbd89c0bba377eb6f9cab802348cb519f91eff093c3ea57ff332ce808c855271b2c0814e21d7afb1ae712babbae98533317c192ca8050dabb535dfe5564ce78ad70481c6d34a28efb9b9bcb0a7f62618815744ec46ef9b93935b0921064362b63d2dadf87bfcd876c41ebc2ab1a1b08afd7ef2dec68da988e5eb05a10c29601cb24bb6d24531136a2a6733e623a8535ca23f7d8b0c4f22e4e2f1410cc95064bdddcde6d740bf4dbccbf46fd00f075af46a119fdbb5c5441e0c15ee2e58f34498e69f2836fdc2ccb936bda9f94d6ed6b42358dd302bff893e22a02f5afc63f0d010333b7e1a8d93a9884d1006860647c248283c310bf9ce5878bd2284d8ee0fbff112dafa2aece79971db9ec9db786cf12f413614032aa584c018fae0fbc7bd9ce4dd1157b283509b5e6551ff8d13d7c16ff7b416b0150fd45766117f490c2e6b613ffdf8924934af313ed11d0c3841708bfed77ac8c14db6124f708bf91f9baf2fff76ce4a44385bb890afc6fc4e48fb5bc2ae26f80f669c83d0c2394bb1929539dd8353520e1443509cd4f8e95d7a162423b8cf294548c1e5ebcaef64d13f47d8a3cd5a460a732be5886eab76081b06862f882608be409646e1456ffa6ae3a0eed1f8634e95c81ef31607f3c961bd1b4c87544dbff7113117da22c697944785c87e16d5fcf311df4ad32936a8e6626f1c63dd0b824873162bd1892a2a93e6d1aa48169c0a8ca65ba637cfda1e8cee2a7cdfbdc87650bb4e05dbb64aae7effb996aa95015688be33bfe00e01d838d6f6ca20108e94617b2293f503b48b4906595e7152223e703e15a2d9d190fd2eeef91b1ee04b512760c59bc908cef46fb7d17662e4ad32a88a9a4a4fc4c35f4020899596a5f3b5d5a50698f99f344017bd73e5d6befe4f668b7483d02edd044c844ebf6fb91e3025ca3bba77f3c8e1dba364c3d1bc9fb26164ebb876c3adc0b9e7fbcc98dedab844c3f95a97547bcfe41c1f754949ce3aba86408f7d4d3c48666c395f8e3a2cf8b5661b19196287dbcf971f9d691237e291494ad457c6b19a69e1611747f2a44425f665119b755d87bd4503bad7582700a3fe0c2207e399c5346a7357565c4f473a23f9b08cb98e3f60d7120118f528eccbcfa1b520074bb9237d3f75e2f384b34ee10b46ce234bb3cc167a2031f1d0f477a2c8f4a0c783e577e4212cf53173f924d0c1c913ddb413da153dbb0f9babf883f2795372eb8ded95134664e9d15d668464714503e4a9749fe59958cb7e84b0614a46b9233a72e5a41b73ee22ddd23d7079285bf104d0d74c350100dc8831d4c574bf9017d57332420bcff73e47c5cd8d022ba9a7f8372d74249bc6278928917ab846fe61dfb4484170621b2a445cc27fc7669c853e49cac4e3e2c77fc504bf3f236f2164c9e43bf56ff53906d3417e6d3141118a74f0dca5b9e5efe0f532b398765a34c20349ba513d6507a26ef289c899d25f683c08d59809251dbb4978545dba7ae842d3995bff45b3fb649c53c9137182393b2e09670ca90c92c31bf0dce1a6d1d8697542ae346de640c76ab6058ea3d919925b5d52a6d3f9932206d96c6fa6cdd5027616ccc42be8997fcdb3d0d82edbf866841f2db881257085b49e8a0cad5a2d7087bbda2c8f3bdd100e85faa2892042a2cee7940435321e0eb9d62ca290a93240fe6ed8d38503e05bf795b6de3596014e702b7092f110cf4342fe7ec9a90acef278c396f0aac8ab88f060ab43d7f1f19a970bd04d1e18052b1f79979ed486009a7688a01d6c06bacee16e7c61ee8e16f517baefcee886e014dec955da2e04f6b252657d54369930939e09fa51f1066a0df2b7534e3494f7d261ca8fc89e44f3340bf5e33953d4bd7d8c8b0a74054cdfd13aa8d0d242aeb1435c71a7c2f2eddb0a2c52d33a1c1539c76e734d5cb166ef8e81eb5e0f299c99a1dfb56293428380491bc49051f6a8fb8d44f80b6eb91a27fb8e2ac0e23e411ed4a9617840a0cf223e53029c5cba627fc9648f5a51f360097e9750866bbf0936e3a829a443b8178e3f3f355e59ede1a8c43f70662b8087f54e9e6fe4cb8d0b7254519763fc7cd198728de1e3d26184fd4fd052f332a3c9ddf72c85879a11cb9d1901c2ed6b9caa7c28c0a0a0b39fb450ac8d1c50dd756e5a0c86edf5f88863d9a2121a29a0061d9d9bf41f818b149a7e2e91f1d984c7ef734b378799f5c42f4867b8abbeb0fae8b325227ff60e94efeb9236f877072c37c75762b1c15431c2a47ee736ff22abc1c65c30235272a33943a96d2e7a6ab3dd05ce93001e975beaec8216cf944a524df62427136f96c897963952dbea2bec275e2097195b4055fa5147e884ae4aaa7ce7ea1eefa90116bb79996d6e98f3116742d3f27dd7974e121b344e15f1e128945550149c6538d27f19d05b7bab7be886f253c9fc992cd9abb63291c6782aa9a4c3fe65e8159fba5ce71a1959893531e8a80dcca93d85ba9151322df5ffa9f97b9d3bd3c34d13f441b668809a3a6e179a0dd8209621323e47feff23611b265ee0e285a5823e024a1c30d46705b70f2ec7bcc948000366cb6dba3906789ca69b5bb4d89f3902986249d61cb92e044392ed49e7a2d4af9d28695c2ba8e6f42c3f74b23a973c825f62008f48247454325196ff9fb4f0f21739e52933bc2abf6fc5b3c4d33b0069ad3538f2ad986348752a28636e7d7f79204a4480df76ce6ad79946afc91952669f5e6742251c636d8df58f7ea9d5773d370c4baa329b290608df71c85f1cc1bd1dd7ac3f9c455383be7cd155864b025f8aed5942d977462d6ee11b31c232ca2dbd5ff2aff60a042e6e09ce9b8cf0fcf39e0adc96ccce928725c16e23cb1ace213f5da42fa8c14acd3f9ebdfb329906e03a4dd177ecbafc5ea7e94458639b00ee6333218d45f4ba75dc90296c56be97f67bb45d8ce3d0e355398303a43d9a891fa0619705019c37f38010000031b49499e653c10156b95ec07c6d809f7ccc27c8ddbe5b1fa0aceaf884f0224839b3818c306e05f7fc3e2fd75fafac61b58750f6c35e8905f9cafce71279dc390fe1a3fca705d6824b0d8cc09d37da57c1d1b4a4d66e6530b46266929222741ddf80e79392fe5a810e8d1048233ef4808ec239700fcef27620ceca59966668832c0bea0b7f50cc46856e19ca58a5c725e176b257451e73cc433640a48b218f32e0c8c4be0c6a4ff5b6a3480af7976ee3baecc6289b211a3ae6d7b71b090c4b0eb36d1c19c188991496d8fb55ad8534961e2cfb6cb6ca83a1eab99f5a4ced5e493f66a31b36f227ffb10332ac96e7c3800c5d207de372ed74b8a4d37ed3d936c798622a5361162abfda3d68c0bfa68e52d1d34d6e6f7f6bad9521a9f160c43e8f11f1fd25a2eaed8c90032d2bef06588e139183bfab481bed653b52c01a32f4ea69efa38c15e1ff3d63e92d6e21293ee3b4ab0f3017194827640057f0325afdf215cfe4852c9c605ca01de1eac5a1faca22b2e79823a6eac8f3ba6739b1492b141185eb85beb10780ccbf1e2c6ba75f5bf84ef3a0cd755e3fe114f1c3cd686762403d01e880071bbee58536bc1db97e19f5fbf56de8b858947dea8a2c5db1c4a8a1e3358395b8f09476d980832f2a7b969df315e0ff238b2904cc1ee93a938602f9e4d5659f7cfd65c5299154182840361d72fdef84505372e9623ea3dd5c0c9dcf693521816dc277816fce85c61956727f2f29a90ec4bf816c465e038681a3816cb67c7b57786f74678a7a5f7e61a39e0cf739f62b3cb95ff3636215922138b6c8fd538932224d35532fee51a1de12d5222bf6f4f34aee14fdbf26a2bf21466a95f5adc00d1a1858d3d8dd5c360d677d18b724399f3f71f9aacde9973eb26429b9616401577cf922d695740bfb27171e72c3d96b295b88c9a3e6cb3bd8b7375c54f92261e3b7365fd6649b5fc9ea10f02de7a391697747fd5e9da68ed4fd7bf36c30d3d474bd1ba6c4f42f9e0a613e345af9e27747d0228d112ee74ab659c2c3fb8d0447639c8729399d18c0dd2a39abe6e0c3f1db20af614068f18a463ef1ab71ba46a8f8baf0e957d3c042b709ee53f6f907dc2d0c000f884275b84473f7c46cb5c7b557e9bd3885c19b972418a3e3b4efcd379048a365e4839756795abb0b8a926f93dc69a0d31ca9e52a4e30bb31a28aaf15f0a5a3b12d0dcb23a05c85e073397a95749a274f78491784c19715885e5a106d4b3338b69af8a5a67f54bff5722e79baf45a2ad464bc36695899dbd776f830c64e70d0d985149f30a8620cb58ce1da265b4ea8eebd1333b3d1b2fb1ae6bf839c1f84dd3d858484f18ba3236e067da2acd47af0355f465b59e2a1c42a6e67e164759630e013927a29fb87dc84bb29c3513813bb866cd26271482de6f02e98e8a6053af0edc6f5b16e26722254d6fbf72b375aa2a8f5ebc4ec3990c25069204e75799a57c103b2423a1e93989ad01aa612eaa3969b6cdb97c7fa0769b1e39858fd5b1db88c5da294b937a6e507531010df4543d6a8b76daf441bdf57581246785e0cf48c2128cb14840e56bef9fd8f890424336aa760f995b06a0ff34712254c23bf3d3c00c26984788448fcb38cf35cfbd20782ccfa66cddb9f94d5f5af9d05d02c654db639f5016b108777560e505c382bbadd0511056f710363b3ce2a681ad6d1ee92c2c5355a9b8055150c02bab99798a8afe54a3b540531ce175c98417edcc532a41d638686ffeecfebc4610b917553ba2a5f1dc9d997a4a14e5745a23f6cf1719642e79283b7af640dbc42aa86c4cdeb64034882f31358aaff9abe60db64522a9eb20968c77479a2b551b85121fbee7cea728d7142f6ceb0acff457df23cfc0201307be83c31594f3a7d8215c83551633bb92077f1e38092909f57abaf14036002be0e2e522fabad0b842fe3f1b0e93fad8c538427f4765e01bd941e42a4fc2638d19c70fc891bf5b67ca4334498223efe1f8e02d11297ba80d6b2bfe31e0a6342b4887b04d1894c0947f7cccc18d01162c91db2680eb7b7ad4736bae1701cae0995174559186f54c6749efda30ce4853c65b2792ad0d2d87538fb0a1b00abca8201d207db95445f6456057778bde77a91b7e4e8fd7d8e6f5f096aafb1daa9af8aebc9b5477b98fcae7b5707d4cfe02ae3e90c3e72e8eabecf2f7a17bcaac06a01d77c6b9ca62b22bf47ab344c904c54a7766d27610995a85131d60c71d21e8b11dc4e1fbd2dbeb4c6e28c2e7b03991bc160a1c79e557a52567d337aea5ebea82328231ecf28e6cc0a7de571103a4bc13043326a9d2d2b549fb8713171d301a942ca9532093fd9367198fadc6634f0bcb1a7db339ca1bce74517247f399c6b083b569638f54d99554c7de68e5f4fa29e72660247f270635e4d18b3de78cf21f76f82b6d67ceec77f9b74e5c2cc19dba8af2d35d29ed2d3e5cf3f9bdd826f58a0e9984ca5b41036ad5a1c7a329ab835aa4fed3d214021e72e214303fe33c0c0c38c355559dbdb1bf56883b4265cb6e7cfc7ca6baf0bde505719c40f880befcdc1f7a43d421e66ebf5fb224b7500616960ccbd2e0c65341f2efe8b8f95f1e9ebbc3fd6670bddfc5bf4da5a85636895a5180071672a0f4ac927fc54de9be433952240cd8db8468e9b2dc9cba482afc9830728bc072f4fe7c89838dc6aec6f5db12b49b05f5a662b75b758b368407f0ace16062b07c7c5bedd9f701d236504d23286240476955fe364d0a34db6870f85add22df0e7e0128127f504583b3e06e5e9599640e51c07d1f3d650b2762d80719885769cb35b115a5b3b709f84ca797fc552b72d576fd3bdab6b3604bc0e4ca654e6a9e58dde488b193c370eacb67dbbc212dd32a21659660f080356dfd9262796444470bdf6601b1c848e4eb6664f9d76fff680ccb563099f2473dfc55043555f206c67f96b76d08e3d9189c82e156e391588a72d4c4cb37babf42d8e9b51ef1b6b8c105c77015d1cecbbc59e00ca4826ebfa97e62fc4dd9704f82a5cba2bef38d7745177f22e2f91399f7519ded72e85b7f2ed9b4c5379bc1497aa9b9ab6ac736ecf24496867c57bff0d3ac39a5b1e0b2b32337a18cf9e8f