CVE-2019-25411
📋 TL;DR
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability in the DHCP configuration endpoint. Attackers can inject malicious JavaScript via the GATEWAY_GREEN parameter in POST requests, potentially compromising administrator sessions. This affects administrators using the web management interface of vulnerable Comodo Dome Firewall installations.
💻 Affected Systems
- Comodo Dome Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to firewall configuration changes, network compromise, or lateral movement into protected networks.
Likely Case
Session hijacking, credential theft, or unauthorized administrative actions through injected malicious scripts.
If Mitigated
Limited impact if administrators use script-blocking browsers or the firewall is not internet-facing.
🎯 Exploit Status
Exploit requires sending crafted POST requests to the DHCP configuration endpoint; proof-of-concept available in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.0 or later
Vendor Advisory: https://cdome.comodo.com/firewall/
Restart Required: Yes
Instructions:
1. Log into Comodo Dome Firewall admin interface. 2. Navigate to System > Updates. 3. Check for available updates. 4. Apply update to version 2.8.0 or later. 5. Restart the firewall appliance as prompted.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall rules to filter malicious script patterns in POST parameters.
WAF-specific configuration required
Network Segmentation
allRestrict access to firewall management interface to trusted administrative networks only.
firewall rule: deny all except trusted IPs to management port
🧯 If You Can't Patch
- Disable DHCP configuration via web interface if not required
- Implement strict Content Security Policy headers to block inline scripts
🔍 How to Verify
Check if Vulnerable:
Test by sending POST request to DHCP endpoint with script payload in GATEWAY_GREEN parameter and checking for script execution.Check Version:
Check version in web interface under System > About or via SSH: show versionVerify Fix Applied:
Verify version is 2.8.0 or later and test that script payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- POST requests to /dhcp endpoint with script-like content in parameters
- Unusual administrator session activity
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in POST parameters to firewall management IP
SIEM Query:
source="firewall_logs" AND uri_path="/dhcp" AND (http_method="POST") AND (param="GATEWAY_GREEN") AND (content CONTAINS "<script>" OR content CONTAINS "javascript:")