-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-25_03.webgui Security Advisory pfSense Topic: Potential XSS in AutoConfigBackup backup list Category: pfSense Base System Module: webgui Announced: 2025-05-16 Credits: Github user NavyTitanium CVE ID: CVE-2024-57273 Affects: pfSense Plus software versions < 25.03 pfSense CE software versions < 2.8.0 Corrected: 2024-12-12 12:23:41 UTC (pfSense Plus master, 25.03) 2024-12-12 12:23:41 UTC (pfSense CE master, 2.8.0) 0. Revision History v1.0 2025-05-16 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description The page at services_acb.php displays the "reason" string when listing backup entries from the server without encoding. This problem is present on pfSense Plus version 24.11, pfSense CE version 2.7.2, and earlier versions of both. III. Impact If a backup entry on the server contains a "reason" string containing malicious content, it may be rendered by the browser. The AutoConfigBackup feature on pfSense software encodes the "reason" string when creating a backup, but this encoding is performed by the client so it may not always happen as expected. For example, if a malicious actor uses their own code to create backup entries on the server for the Device Key of the target. Due to the lack of encoding on the "reason" content, when services_acb.php lists remote backups stored on the AutoConfigBackup server can be susceptible to XSS. There is a potential that arbitrary JavaScript could be executed in the user's browser. The user's session cookie or other information from the session may be compromised. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Do not allow any untrusted parties to know the AutoConfigBackup Device Key of a host running pfSense software. * Do not log into the firewall with the same browser used for non- administrative web browsing. V. Solution Users can upgrade to pfSense Plus software version 25.03 or later, or pfSense CE software versions after 2.8.0 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 24.11 and pfSense CE version 2.7.2 may apply the fix from the recommended patches list in the System Patches package. Users may also manually apply the relevant revisions below using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 84d8eddf87607e0f9dcc313bcaad4db67e4f3750 pfSense/master 84d8eddf87607e0f9dcc313bcaad4db67e4f3750 - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmgnYzMACgkQE7mH/ZIU +NrvRw//YjJgGn2KjVDK1bfMqdcUmB9dMoQXHjsmcCg9/NTJjGtZXeHonmnA3rc3 GQDDECbrHxQfv8s3htpT0o+75p3K1dwRddhyXcPxVA1mDRgJMbVqO17WIalyBR+M 0toeCKolExJhc837uOALUP+kIDWsIqH06MPapPMmBZXb/NFzi43+BfHPDNamA4jz uCaWut+4xmkAjOSerAF4+42SJiyqEJM3sng72HUUjWB7KUKkukmH8ACpGAryJpnC CXlzGKqH+c5YuE8HPDRzEezwAYBZJV/PLpwVcCcKYDvbOaKQcPXI9qtNG0eDmyZj iTKUGA1zR1Wh1nh6Rs355WetZN2cWrY0GotIXQ9omG8HFJroLXSIRw100T/KN0FF rTSVMqFHNxuK3Cbt3rP9a74cTzPQJ80TZSM5rsrwmagkn+SgY4Z+JjHqnP+UadQ2 ZRBDfDiESsMPDk7hatCIZf+gUk28Bbh7TOiunzzA6Hw5XPp7+CEoJgzylH3ci6Zm Q5ZSLULuaA5qR4qi2szhJddLGap4grrY2g4X+fQMzSpn+qRCkNu0iUMKdF1XPOqd 0EycmynyACz/fpm3JpRJfewhYthNeuyZ1OvL9vHw2dS56dQ3YdFeaGfXilhdb6CX qbCg6MBseYqqaPz0a1uwDqm6jIe/vE6wfHordztGG4XHenRMJmk= =o9Q7 -----END PGP SIGNATURE-----