Rapid7 Vulnerability & Exploit Database

pfSense: pfSense-SA-23_01.webgui: XSS vulnerability in the WebGUI

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

pfSense: pfSense-SA-23_01.webgui: XSS vulnerability in the WebGUI

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
02/15/2023
Created
02/17/2023
Added
02/16/2023
Modified
02/17/2023

Description

A potential Cross-Site Scripting (XSS) vulnerability was found in diag_edit.php, a component of the pfSense Plus and pfSense CE software GUI. The page did not sanitize the contents of filenames read from disk in the "file" and "fqpn" variables, nor did it encode the output when it included those values. This problem is present on pfSense Plus version 22.05.1, pfSense CE version 2.6.0, and earlier versions of both. N.B.: pfSense Plus version 22.05.1 included a partial fix which covered the "file" parameter. An authenticated user having sufficient access to create files with arbitrary names on the firewall filesystem can break rendering of the page. Exploit potential is minimized both by the fact that users with access to create files typically already have root-level access and by the fact that "/" is not valid in filenames, so tags cannot be closed. Even so, there is a theoretical potential for XSS here, even if a viable exploit has not yet been discovered. If this were exploitable, then due to the lack of proper encoding on the affected parameters susceptible to XSS, arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised.

Solution(s)

  • pfsense-upgrade-latest

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;