Comodo Dome Firewall 2.7.0 allows malicious script injection in admin browser

Summary

If an attacker sends a special message to the Comodo Dome Firewall, they can trick an administrator's web browser into running malicious scripts, potentially allowing them to take control of the system. This only affects administrators who use the web interface of Comodo Dome Firewall 2.7.0. To protect your system, update to a newer version of Comodo Dome Firewall.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
comodo	dome_firewall	<= 2.7.0	–

Original title

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the /korugan/proxyconfig endpoint that allow attackers to inject malicious scripts through POST parame...

Original description

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the /korugan/proxyconfig endpoint that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted POST requests with JavaScript payloads in parameters like PROXY_PORT, VISIBLE_HOSTNAME, ADMIN_MAIL_ADDRESS, CACHE_MEM, MAX_SIZE, MIN_SIZE, and DST_NOCACHE to execute arbitrary scripts in administrator browsers.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://cdome.comodo.com/firewall/ Product
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=92... Not Applicable
https://www.exploit-db.com/exploits/46408 Exploit Third Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-cross-site-scripting-v... Third Party Advisory