pfSense: pfSense-SA-23_01.webgui: XSS vulnerability in the WebGUI

Description

A potential Cross-Site Scripting (XSS) vulnerability was found in diag_edit.php, a component of the pfSense Plus and pfSense CE software GUI. The page did not sanitize the contents of filenames read from disk in the "file" and "fqpn" variables, nor did it encode the output when it included those values. This problem is present on pfSense Plus version 22.05.1, pfSense CE version 2.6.0, and earlier versions of both. N.B.: pfSense Plus version 22.05.1 included a partial fix which covered the "file" parameter. An authenticated user having sufficient access to create files with arbitrary names on the firewall filesystem can break rendering of the page. Exploit potential is minimized both by the fact that users with access to create files typically already have root-level access and by the fact that "/" is not valid in filenames, so tags cannot be closed. Even so, there is a theoretical potential for XSS here, even if a viable exploit has not yet been discovered. If this were exploitable, then due to the lack of proper encoding on the affected parameters susceptible to XSS, arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised.