CVE-2026-34812: Endian Firewall Stored XSS Vulnerability

CVE-2026-34812 Overview

CVE-2026-34812 is a stored cross-site scripting (XSS) vulnerability affecting Endian Firewall version 3.3.25 and prior versions. The vulnerability exists in the mimetypes parameter of the /cgi-bin/proxypolicy.cgi endpoint. An authenticated attacker can inject arbitrary JavaScript code that is stored on the server and subsequently executed when other users view the affected page, potentially leading to session hijacking, credential theft, or malicious actions performed in the context of victim users.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript code into the firewall's web interface, which executes in the browsers of other administrators viewing the affected proxy policy configuration pages.

Affected Products

• Endian Firewall version 3.3.25
• Endian Firewall versions prior to 3.3.25

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34812 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34812

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) occurs due to insufficient input sanitization in the Endian Firewall web management interface. The proxypolicy.cgi script fails to properly validate and sanitize user-supplied input in the mimetypes parameter before storing it and rendering it back to users. When an authenticated user with access to proxy policy configuration submits malicious JavaScript code through this parameter, the payload is stored in the system's configuration. Subsequently, when any user (including administrators) views the proxy policy page, the stored JavaScript executes within their browser session.

The vulnerability requires authentication to exploit, which limits the initial attack surface. However, once exploited, the persistent nature of stored XSS makes it particularly dangerous in firewall management environments where multiple administrators may access the same configuration interfaces. An attacker could leverage this vulnerability to steal session cookies, capture administrator credentials, modify firewall rules without authorization, or redirect users to malicious sites.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the Endian Firewall's web interface. The proxypolicy.cgi CGI script accepts the mimetypes parameter without adequately sanitizing special characters that have meaning in HTML and JavaScript contexts. When this unsanitized data is rendered back to users viewing the proxy policy configuration, the browser interprets any embedded script tags or JavaScript event handlers as executable code rather than text content.

Attack Vector

The attack vector is network-based and requires prior authentication to the Endian Firewall management interface. An attacker with valid credentials (potentially obtained through phishing, credential stuffing, or as a lower-privileged user) navigates to the proxy policy configuration page and injects malicious JavaScript payloads into the mimetypes field. Common XSS payloads include script tags containing code to exfiltrate cookies, keyloggers to capture credentials, or code that performs administrative actions using the victim's session. The injected payload persists in the system configuration and executes each time any user loads the affected page.

Detection Methods for CVE-2026-34812

Indicators of Compromise

• Unusual JavaScript content in proxy policy configuration files or database entries
• Unexpected network requests from administrator browsers to external domains
• Log entries showing modifications to the mimetypes parameter containing script tags or encoded JavaScript
• Session anomalies where administrator accounts perform actions without corresponding user activity

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payloads in HTTP requests to /cgi-bin/proxypolicy.cgi
• Monitor access logs for suspicious patterns in the mimetypes parameter such as <script>, javascript:, or encoded equivalents
• Deploy browser-based security solutions that can detect and block XSS execution attempts
• Conduct regular security audits of stored configuration data for malicious content

Monitoring Recommendations

• Enable detailed logging for all CGI script interactions on the Endian Firewall
• Implement Content Security Policy (CSP) headers to restrict script execution sources
• Set up alerts for configuration changes to proxy policies, particularly those involving MIME type settings
• Monitor for outbound connections from the management interface to unexpected destinations

How to Mitigate CVE-2026-34812

Immediate Actions Required

• Restrict access to the Endian Firewall management interface to trusted networks and IP addresses only
• Review and audit existing proxy policy configurations for any suspicious JavaScript content in the mimetypes field
• Implement network segmentation to limit potential attacker access to authenticated firewall management sessions
• Enable multi-factor authentication for all administrative accounts if supported

Patch Information

At the time of publication, consult the Endian Community Support portal for the latest security updates and patch availability. Review the VulnCheck Advisory on Endian for additional technical details and remediation guidance. Organizations should prioritize upgrading to patched versions when available.

Workarounds

• Implement strict input validation using a web application firewall positioned in front of the Endian management interface
• Restrict administrative access to the /cgi-bin/proxypolicy.cgi endpoint to only essential personnel
• Use browser extensions that block JavaScript execution from untrusted sources when accessing the management interface
• Consider implementing additional authentication layers or access controls for the proxy policy configuration pages