pfSense: pfSense-SA-18_02.webgui: XSS vulnerability in the WebGUI

A Cross-Site Scripting (XSS) vulnerability was found in
diag_system_activity.php, a part of the pfSense software WebGUI, on version
2.3.5-p1 and earlier (2.3.x branch) and on version 2.4.2-p1 and earlier (2.4.x
branch).

On diag_system_activity.php, the output of the "top" command was printed to the
user without encoding, which could be used as an XSS vector.

Due to the lack of proper encoding on the affected output susceptible to XSS,
arbitrary JavaScript can be executed in the user's browser. The user's session
cookie or other information from the session may be compromised.

Exploiting this requires that the attacker already have sufficient access to the
firewall to run arbitrary processes at the command prompt (console or ssh) or
via diag_command.php, which makes this attack impractical, but the possibility
remains that such a process could be triggered by other means.