CVE-2025-34175
📋 TL;DR
This reflected cross-site scripting vulnerability in pfSense CE's Suricata interface allows attackers to inject malicious scripts that execute in authenticated users' browsers. The vulnerability affects administrators and users with access to the Suricata file check functionality. Successful exploitation requires the victim to be authenticated to the pfSense web interface.
💻 Affected Systems
- pfSense CE
📦 What is this software?
Pfsense by Pfsense
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, perform actions as the authenticated user, or redirect to malicious sites, potentially leading to full system compromise.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed within the authenticated user's context.
If Mitigated
Limited impact due to authentication requirement and reflected nature; proper input validation prevents exploitation.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing commit 97852ccfd201b24ee542be30af81272485fde0b4
Vendor Advisory: https://redmine.pfsense.org/issues/16414
Restart Required: No
Instructions:
1. Update pfSense CE to latest version. 2. Apply the specific patch from the GitHub commit. 3. No service restart required for web interface changes.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom input validation for the filehash parameter to sanitize HTML characters
Not applicable - requires code modification
🧯 If You Can't Patch
- Restrict access to the Suricata interface to trusted users only
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if /usr/local/www/suricata/suricata_filecheck.php exists and examine the filehash parameter handlingCheck Version:
pkg info pfSense | grep VersionVerify Fix Applied:
Verify the patch commit 97852ccfd201b24ee542be30af81272485fde0b4 is present in your installation📡 Detection & Monitoring
Log Indicators:
- Unusual filehash parameter values in web server logs
- Multiple failed authentication attempts followed by filecheck access
Network Indicators:
- HTTP requests to suricata_filecheck.php with suspicious filehash parameters
SIEM Query:
source="pfSense-web" AND uri="/suricata/suricata_filecheck.php" AND (filehash CONTAINS "<script>" OR filehash CONTAINS "javascript:")