Description

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject  some malicious script in a group’s comments in the webservices administration interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T15:17:32.540Z",
  "pubdate": "2026-09-04T15:17:32.540Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within the web administration panel of Stormshield SNS firewalls. This vulnerability allows an authenticated administrator to inject arbitrary malicious scripts into the 'comments' field associated with a security group within the webservices administration interface. The script is stored persistently on the server and executes in the context of any other administrator's browser session when they view the compromised group information. The primary impact involves the unauthorized execution of JavaScript, potentially leading to session hijacking, unauthorized configuration changes, or the performance of administrative actions on behalf of the victim. Exploitation requires authenticated access to the management interface with sufficient privileges to modify group comments. This flaw poses a significant risk to the integrity and confidentiality of the firewall's administrative console.",
  "technicalDetails": "The vulnerability originates from a lack of proper input validation and output encoding within the webservices administration interface of the Stormshield SNS web panel. Specifically, the 'comments' field associated with security groups fails to sanitize user-supplied input, allowing for the inclusion of executable JavaScript or HTML tags. When the application persists this input in the backend database without adequate contextual encoding, it renders the input vulnerable to stored XSS upon retrieval.\nThe attack flow begins when an attacker with administrative access navigates to the group management section within the web administration panel. The attacker injects a malicious payload into the comment field. Because the application lacks server-side input filtering, the script is saved directly to the configuration storage.\nWhen a secondary administrator accesses the affected group's configuration, the management interface retrieves the malicious payload and renders it within the DOM of the administrator's browser session. The browser, trusting the source, executes the injected JavaScript code. This code operates under the security context of the victim's authenticated session, meaning it can interact with the DOM, capture session cookies, or trigger unauthorized API requests to the SNS appliance.\nThe payload can be crafted to perform various post-exploitation actions, such as exfiltrating the victim's session tokens to an external server, modifying firewall rules, creating new administrative accounts, or altering system logs to obfuscate malicious activity. As the interaction occurs within the trusted administrative network zone, the exploit bypasses perimeter security controls and leverages the inherent trust placed in the management console's display mechanisms."
}