CVE-2019-25424
📋 TL;DR
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability in the EXCEPTIONSITELIST parameter. Attackers can inject malicious JavaScript via POST requests to the https_exceptions endpoint, potentially stealing session cookies or performing actions as authenticated users. This affects administrators and users accessing the firewall web interface.
💻 Affected Systems
- Comodo Dome Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the firewall, reconfigure rules, disable security controls, or pivot to internal networks.
Likely Case
Attackers steal user session data, perform actions as authenticated users, or redirect to phishing sites.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution.
🎯 Exploit Status
Exploitation requires the victim to click a malicious link while authenticated; exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.0 or later
Vendor Advisory: https://cdome.comodo.com/firewall/
Restart Required: Yes
Instructions:
1. Log into Comodo support portal. 2. Download latest version (2.8.0+). 3. Backup configuration. 4. Install update. 5. Restart firewall services.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall rules to sanitize EXCEPTIONSITELIST parameter inputs.
# Example mod_security rule for Apache:
SecRule ARGS:EXCEPTIONSITELIST "@rx <script" "id:1001,phase:2,deny,status:403,msg:'XSS attempt detected'"
Content Security Policy
allImplement CSP headers to restrict script execution sources.
# Add to web server configuration:
Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
# For Apache: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
🧯 If You Can't Patch
- Restrict firewall management interface access to trusted IP addresses only using network ACLs.
- Implement session timeout policies and require re-authentication for sensitive actions.
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> to EXCEPTIONSITELIST parameter via POST to https_exceptions endpoint; if alert executes, system is vulnerable.Check Version:
Log into web interface and check version in dashboard or run: # grep 'Version' /opt/comodo/dome/version.txtVerify Fix Applied:
Repeat vulnerability test; script should be properly encoded or blocked. Check version is 2.8.0 or higher.📡 Detection & Monitoring
Log Indicators:
- POST requests to /https_exceptions with script tags in parameters
- Unusual parameter values containing JavaScript keywords in web logs
Network Indicators:
- HTTP requests with EXCEPTIONSITELIST parameter containing <script> tags
- Outbound connections to suspicious domains following management interface access
SIEM Query:
source="firewall_web_logs" AND (method="POST" AND uri="/https_exceptions" AND (param="EXCEPTIONSITELIST" AND value="*<script>*"))