Description
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Netgate pfSense CE
Default version status: unaffected
2.3.0 to ≤ 2.9.0affected
pkg:github/pfsense/pfsenseReferences
- https://github.com/abraxas/pfsense-separator-color-xss ↗
- https://abraxaslabs.tech/research/pfsense-ce-leftovers ↗
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/filter.inc#L6238-L6252 ↗
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L236-L245 ↗
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.3.0-through-2.9.0-stored-xss-via-separator-color ↗