CVE-2025-34178
📋 TL;DR
This stored XSS vulnerability in pfSense CE's Suricata package allows authenticated attackers with specific permissions to inject malicious scripts into the web interface. When other administrators view the affected page, the scripts execute in their browser context, potentially compromising their sessions or performing unauthorized actions. Only users with 'WebCfg - Services: suricata package' permissions are affected.
💻 Affected Systems
- pfSense CE
📦 What is this software?
Pfsense by Pfsense
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, perform CSRF attacks to change firewall rules, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Session hijacking of administrators viewing the Suricata configuration page, allowing the attacker to perform actions with the victim's privileges.
If Mitigated
Limited to authenticated users with specific permissions; impact contained to administrative interface with proper network segmentation.
🎯 Exploit Status
Requires authenticated access with specific permissions. Exploitation involves injecting XSS payloads into the policy_name parameter that get stored and executed when viewed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing commit 97852ccfd201b24ee542be30af81272485fde0b4
Vendor Advisory: https://redmine.pfsense.org/issues/16414
Restart Required: No
Instructions:
1. Update pfSense CE to latest version. 2. Apply the specific patch from commit 97852ccfd201b24ee542be30af81272485fde0b4. 3. No service restart required.
🔧 Temporary Workarounds
Remove vulnerable permissions
allTemporarily remove 'WebCfg - Services: suricata package' permissions from non-essential users
Disable Suricata package
allIf not needed, disable the Suricata package entirely
🧯 If You Can't Patch
- Restrict access to Suricata configuration page to only essential administrators
- Implement Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if your pfSense version includes the vulnerable code in /suricata/suricata_app_parsers.php before the fix commitCheck Version:
pfSense version check via web interface or 'cat /etc/version' on CLIVerify Fix Applied:
Verify that the policy_name parameter in /suricata/suricata_app_parsers.php now properly sanitizes HTML characters before display📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to Suricata policy names containing script tags or JavaScript
- Multiple failed authentication attempts followed by successful login to Suricata interface
Network Indicators:
- Unexpected outbound connections from pfSense admin interface to external domains
SIEM Query:
source="pfSense" AND (event_type="web_access" AND uri="/suricata/suricata_app_parsers.php" AND (params CONTAINS "<script>" OR params CONTAINS "javascript:"))