Description
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Netgate pfSense CE
Default version status: unaffected
2.7.1 to ≤ 2.9.0affected
pkg:github/pfsense/pfsenseReferences
- https://github.com/abraxas/pfsense-rules-if-xss ↗
- https://abraxaslabs.tech/research/pfsense-ce-leftovers ↗
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L138-L146 ↗
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/firewall_rules.php#L391 ↗
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.1-through-2.9.0-reflected-xss-via-firewall-rules-php ↗