Executive brief
A security vulnerability exists in the Suricata intrusion detection package for pfSense firewalls. An authenticated user with specific permissions can inject malicious scripts into the management interface via the 'policy_name' parameter. If another administrator views the affected configuration page, the script could execute in their browser, potentially leading to unauthorized actions or data theft within the management console.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Suricata package for pfSense (CE and Plus) within the 'suricata_flow_stream.php' component. The root cause is the failure to sanitize or encode the 'policy_name' parameter before it is rendered in the web interface. An attacker authenticated with 'WebCfg - Services: suricata package' permissions can inject arbitrary HTML or JavaScript. This script is then stored on the server and executed in the context of any user who subsequently views the affected page. The vulnerability was addressed in Suricata package version 7.0.8_3 (and later) and is included in pfSense CE 2.8.0 and pfSense Plus 25.07.1.
Affected products
- Netgate pfSense CE < 2.8.0
- Netgate pfSense Plus < 25.07.1
- Netgate Suricata package for pfSense <= 7.0.8_2
Timeline
- 2025-09-09: disclosed
- 2025-09-09: patched: Fix committed to FreeBSD-ports repository
- 2025-09-09: advisory