CVE-2026-27177: MajorDoMo Stored XSS Vulnerability

CVE-2026-27177 Overview

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrator views the property editor in the admin panel, the stored values are rendered without escaping in both a paragraph tag (SOURCE field) and a textarea element (VALUE field). The XSS fires on page load without requiring any click from the admin.

Additionally, the session cookie lacks the HttpOnly flag, enabling session hijack via document.cookie exfiltration. An attacker can enumerate properties via the unauthenticated /api.php/data/ endpoint and poison any property with malicious JavaScript.

Critical Impact

Unauthenticated attackers can inject persistent JavaScript payloads that execute automatically when administrators access the admin panel, potentially leading to session hijacking and full administrative account takeover.

Affected Products

• MajorDoMo (Major Domestic Module) - Home Automation Platform
• MajorDoMo installations with exposed /objects/?op=set endpoint
• MajorDoMo deployments accessible from untrusted networks

Discovery Timeline

• 2026-02-18 - CVE-2026-27177 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-27177

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists due to insufficient input validation and output encoding in MajorDoMo's property management system. The /objects/?op=set endpoint was intentionally designed without authentication to facilitate IoT device integration, creating an attack surface that allows remote unauthenticated attackers to inject malicious payloads.

The vulnerability is particularly dangerous because the injected JavaScript executes automatically when an administrator loads the property editor page—no user interaction beyond page navigation is required. The lack of the HttpOnly flag on session cookies compounds the risk by enabling straightforward session token theft through document.cookie access.

Root Cause

The root cause stems from a design decision to leave the /objects/?op=set endpoint unauthenticated combined with missing input sanitization and output encoding. User-supplied property values are stored directly in the database without any filtering or encoding. When these values are subsequently rendered in the admin panel, they are output directly into HTML elements (paragraph tags and textarea elements) without proper escaping, allowing arbitrary JavaScript execution in the administrator's browser context.

Attack Vector

An attacker can exploit this vulnerability through the following network-based attack chain:

1. Reconnaissance: The attacker enumerates available properties by querying the unauthenticated /api.php/data/ endpoint to discover valid property names and current values.

2. Payload Injection: Using the unauthenticated /objects/?op=set endpoint, the attacker submits a crafted request containing malicious JavaScript in a property value field.

3. Persistence: The malicious payload is stored raw in the MajorDoMo database without any sanitization.

4. Execution: When an administrator navigates to the property editor in the admin panel, the stored payload is rendered without escaping in both the SOURCE paragraph tag and VALUE textarea element, causing the JavaScript to execute immediately on page load.

5. Session Hijacking: Due to the missing HttpOnly flag on session cookies, the attacker's JavaScript can access document.cookie and exfiltrate the administrator's session token to an attacker-controlled server, enabling full account takeover.

For detailed technical analysis and proof-of-concept information, refer to the Chocapikk Blog Post and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-27177

Indicators of Compromise

• Unexpected or suspicious JavaScript code appearing in property values within the MajorDoMo database
• HTTP requests to /objects/?op=set from external IP addresses or unexpected sources containing script tags or JavaScript event handlers
• Outbound connections from administrator browsers to unknown external domains during admin panel access
• Unusual modifications to property values, particularly those containing encoded script content or event handlers

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing XSS payloads targeting the /objects/?op=set endpoint
• Monitor access logs for suspicious patterns of requests to /api.php/data/ followed by /objects/?op=set from the same source IP
• Deploy browser-based XSS detection tools or Content Security Policy (CSP) violation reporting to identify script execution anomalies
• Audit database property values regularly for unexpected HTML/JavaScript content

Monitoring Recommendations

• Enable detailed logging for all requests to the /objects/ and /api.php/ endpoints
• Configure alerts for requests containing common XSS payload patterns such as <script>, javascript:, or event handlers like onerror
• Monitor network traffic for session cookie exfiltration attempts to external domains
• Implement anomaly detection for administrator session activity following admin panel access

How to Mitigate CVE-2026-27177

Immediate Actions Required

• Restrict network access to the /objects/?op=set endpoint to trusted IoT devices and internal networks only using firewall rules or reverse proxy configurations
• Implement authentication requirements for the /objects/?op=set endpoint if operationally feasible
• Add the HttpOnly flag to session cookies to prevent JavaScript-based session token theft
• Review and sanitize existing property values in the database for malicious content

Patch Information

A fix has been submitted via GitHub Pull Request #1177. Organizations should monitor this pull request for merge status and apply the patch once available. Review the VulnCheck Security Advisory for the latest remediation guidance.

Workarounds

• Deploy a reverse proxy or web application firewall to filter incoming requests to /objects/?op=set for XSS patterns and restrict access by source IP
• Implement Content Security Policy (CSP) headers to prevent inline script execution and restrict script sources to trusted domains
• Manually configure session cookies with the HttpOnly and Secure flags at the web server level if application-level changes are not immediately possible
• Isolate the MajorDoMo instance on a dedicated network segment accessible only from trusted internal systems

# Example: Restrict access to vulnerable endpoint via nginx
location /objects/ {
    # Allow only trusted IoT device network
    allow 192.168.10.0/24;
    deny all;
    
    proxy_pass http://majordomo_backend;
}

# Add security headers
add_header Content-Security-Policy "default-src 'self'; script-src 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;