abraxas/pfsense-rss-body-xsspfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - XSS - RSS body leftover of 26_04
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-rss-body-xss
Class: XSS Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
26_04 encodes the title. Body is strip_tags only. Permalink is raw href.
| ID | no CVE yet |
| Class | XSS |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-79 |
| CVSS | Medium: 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with page-all / dashboard widgets |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19150.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| RSS feed item description / link rendered by rss.widget.php | strip_tags body; raw permalink href | Integrity: Lab-proven: body onerror leftover and permalink javascript: with the witness. Title encoded. |
| same leftover | same sink | Recon: Inferred: dashboard XSS as the logged-in user. |
| same leftover | same sink | Availability: None shown. |
Requires: page-all / dashboard widgets. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: page-all / dashboard widgets. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
26_04 title encode.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19150. Compose project pfsense-rss-body-xss. Witness PFSENSE-RSS-BODY-XSS-WITNESS. Loopback only: 127.0.0.1:19150. Compose project pfsense-rss-body-xss. Witness PFSENSE-RSS-BODY-XSS-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-RSS-BODY-XSS title-encoded=yes body-onerror=yes permalink-javascript=yes PFSENSE-RSS-BODY-XSS-WITNESS
htmlspecialchars body text. Allowlist permalink to http(s).
9363ac5b8651a1c7a333180425ce7719070f95f9