CVE-2019-25381
📋 TL;DR
This vulnerability allows attackers to inject malicious JavaScript into Smoothwall Express web interface pages through unvalidated parameters in the hosts.cgi script. When users view the affected pages, the injected scripts execute in their browsers, potentially stealing session cookies or performing actions on their behalf. Organizations running Smoothwall Express 3.1-SP4-polar-x86_64-update9 are affected.
💻 Affected Systems
- Smoothwall Express
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the Smoothwall firewall, reconfigure firewall rules, intercept network traffic, or deploy malware to internal systems.
Likely Case
Attackers steal user session cookies to hijack authenticated sessions, perform unauthorized actions, or redirect users to malicious sites.
If Mitigated
Limited to session hijacking of users who click malicious links, with minimal impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB; exploitation requires user interaction (clicking malicious link).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update10 or later
Vendor Advisory: http://www.smoothwall.org
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download and install Smoothwall Express 3.1-SP4-polar-x86_64-update10 or later from smoothwall.org. 3. Restart the Smoothwall system. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd input validation to hosts.cgi script to sanitize IP, HOSTNAME, and COMMENT parameters
sed -i 's/param_name/escaped_param_name/g' /path/to/hosts.cgi
Web Application Firewall
allDeploy WAF rules to block XSS payloads in POST requests to hosts.cgi
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline script execution
- Restrict access to Smoothwall web interface to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Test by submitting POST request to /cgi-bin/hosts.cgi with <script>alert('XSS')</script> in IP parameter and check if script executesCheck Version:
cat /var/smoothwall/main/versionVerify Fix Applied:
After patching, repeat the test; script should be properly encoded and not execute📡 Detection & Monitoring
Log Indicators:
- POST requests to /cgi-bin/hosts.cgi containing script tags or JavaScript in parameters
- Unusual parameter values in web access logs
Network Indicators:
- HTTP POST requests to hosts.cgi with suspicious parameter values
- Outbound connections to unknown domains after visiting management interface
SIEM Query:
source="web_access.log" AND uri="/cgi-bin/hosts.cgi" AND (param="<script>" OR param="javascript:")