pfSense: pfSense-SA-17_09.webgui: Multiple XSS vulnerabilities in the WebGUI Dashboard
Description
Cross-Site Scripting (XSS) vulnerabilities were found in the dashboard and widgets, components of the pfSense software WebGUI, on version 2.4.1 and earlier of the 2.4.x release branch. * On index.php, the "sequence" parameter component for multiple widget instance counters was not validated and it was echoed back to the user directly without encoding. A specially-crafted submission could store an invalid widget sequence which could be used as an XSS vector. * On numerous widgets which support multiple instances, the widgetkey parameter was taken from $_REQUEST and echoed back to the user directly without encoding, which could be used as an XSS vector. Due to the lack of proper encoding on the affected variable susceptible to XSS, arbitrary JavaScript can be executed in the user's browser. The user's session cookie or other information from the session may be compromised.
Solution(s)
- pfsense-upgrade-latest
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center