Comodo Dome Firewall Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Comodo Dome Firewall version 2.7.0. This vulnerability allows attackers to inject malicious scripts by sending crafted input to the openvpn_advanced endpoint. The injection occurs through the GLOBAL_NETWORKS and GLOBAL_DNS parameters via POST requests, enabling the execution of arbitrary JavaScript in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the openvpn_advanced endpoint with crafted input that includes JavaScript code in the GLOBAL_NETWORKS or GLOBAL_DNS parameters. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.