CVE-2019-25405
📋 TL;DR
Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability in the license activation endpoint. Attackers can inject malicious JavaScript via the newLicense parameter, which executes in administrators' browsers when viewing license management pages. This affects administrators of Comodo Dome Firewall installations.
💻 Affected Systems
- Comodo Dome Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to firewall configuration changes, network rule manipulation, credential theft, and full network access.
Likely Case
Session hijacking of administrator accounts, credential theft, and unauthorized configuration changes to the firewall.
If Mitigated
Limited impact if administrators use separate accounts for firewall management and have strong session management controls.
🎯 Exploit Status
Exploitation requires sending POST requests to the license activation endpoint with JavaScript payloads. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.0 or later
Vendor Advisory: https://cdome.comodo.com/firewall/
Restart Required: Yes
Instructions:
1. Log into Comodo Dome Firewall admin interface. 2. Navigate to System > Updates. 3. Check for available updates. 4. Apply update to version 2.8.0 or later. 5. Restart the firewall service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to sanitize newLicense parameter values
Not applicable - requires code changes
Content Security Policy
allImplement CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Restrict access to the firewall management interface to trusted IP addresses only
- Use separate administrator accounts with minimal privileges for license management tasks
🔍 How to Verify
Check if Vulnerable:
Check if running Comodo Dome Firewall version 2.7.0 by logging into admin interface and viewing System > AboutCheck Version:
Not applicable - check via web interface onlyVerify Fix Applied:
Verify version is 2.8.0 or later in System > About page📡 Detection & Monitoring
Log Indicators:
- POST requests to /license/activate with JavaScript payloads in newLicense parameter
- Unusual license activation attempts
Network Indicators:
- HTTP POST requests containing script tags or JavaScript code in license activation endpoints
SIEM Query:
source="firewall_logs" AND (url_path="/license/activate" AND (method="POST" AND (content CONTAINS "<script>" OR content CONTAINS "javascript:")))