pfsense 2.3.2 Cross Site Scripting

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: pfsense 2.3.2  
Fixed in: 2.3.3  
Fixed Version Link: https://pfsense.org/download/  
Vendor Website: https://www.pfsense.org/  
Vulnerability Type: XSS  
Remote Exploitable: Yes  
Reported to vendor: 02/06/2017  
Disclosed to public: 03/24/2017  
Release mode: Coordinated Release  
CVE: requested via DWF  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
pfsense is an open source firewall. The web interface is written in PHP. In  
version 2.3.2-RELEASE (amd64), it is vulnerable to reflected XSS. XSS can lead  
to disclosure of cookies, session tokens etc.  
  
3. Details  
  
XSS 1  
  
CVSS: Medium; 6.1 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/  
PR:N/UI:R/S:C/C:L/I:L/A:N  
  
Description: When performing a package reinstall via the package manager, the  
"from" and "to" parameter are vulnerable to reflected XSS.  
  
Proof of Concept:  
  
http://192.168.178.60/pkg_mgr_install.php?mode=reinstallpkg&pkg=  
pfSense-pkg-arping&from='"><img src=no onerror=alert(1)>&to='"><img src=no  
onerror=alert(1)>  
  
Note that while the "pkg" parameter must be a valid package, it does not need  
to actually be installed on the system.  
  
Code:  
  
pkg_mgr_install.php <?=sprintf(gettext('Confirmation Required to upgrade  
package %1$s from %2$s to %3$s.'), $pkgname, $_GET['from'], $_GET['to'])?>  
  
XSS 2  
  
CVSS: Medium; 4.7 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/  
PR:N/UI:R/S:C/C:L/I:L/A:N  
  
Description: The pkg_filter Parameter of the pkg.php file is vulnerable to  
reflected XSS. It should be noted that the xml Parameter must point to an  
existing xml file, which must contain a field with the type sorting and the  
include_filtering_inputbox tag set. According to the vendor, the FreeRADIUS  
package is affected.  
  
Proof of Concept:  
  
192.168.10.150/pkg.php?xml=miniupnpd.xml&pkg_filter='"><img src=no onerror=  
alert(1)>  
  
Code:  
  
pkg.php echo " Filter text: <input id='pkg_filter' name='pkg_filter' value='"  
. $_REQUEST['pkg_filter'] . "' /> <input type='submit' value='Filter' />";  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 2.3.3:  
  
https://pfsense.org/download/  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
02/06/2017 Informed Vendor about Issue  
02/07/2017 Vendor confirms + fixes issues in git  
02/20/2017 Vendor relases fix + vendor advisory  
03/24/2017 Disclosed to public  
  
  
Blog Reference:  
https://www.curesec.com/blog/article/blog/pfsense-232-XSS-197.html  
  
--  
blog: https://www.curesec.com/blog  
Atom Feed: https://www.curesec.com/blog/feed.xml  
RSS Feed: https://www.curesec.com/blog/rss.xml  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany  
  
  
`