Executive brief
A security vulnerability exists in the Suricata intrusion detection package for pfSense firewalls. An attacker could trick an authenticated administrator into clicking a malicious link, allowing the attacker to execute unauthorized scripts within the administrator's browser session. This could lead to unauthorized configuration changes or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Suricata package for pfSense (CE and Plus) within the 'suricata_filecheck.php' component. The root cause is the failure to sanitize the 'filehash' GET parameter before rendering it in the HTML response. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in Suricata package versions following 7.0.8_2, available for pfSense CE 2.8.0 and pfSense Plus 25.07.0 and later.
Affected products
- Netgate pfSense CE < 2.8.0
- Netgate pfSense Plus < 25.07.0
- Netgate Suricata package for pfSense <= 7.0.8_2
Timeline
- 2025-09-09: disclosed
- 2025-09-09: patched: Fix committed to FreeBSD-ports repository
- 2025-09-09: advisory