Executive brief
Netgate pfSense, a popular open-source firewall and routing platform, contains a security flaw in its Suricata intrusion detection package. An authenticated user with specific service permissions can inject malicious scripts into the management interface. If another administrator views the affected configuration page, the script could execute in their browser, potentially allowing the attacker to perform unauthorized actions or steal session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the pfSense Suricata package within the '/suricata/suricata_app_parsers.php' file. The root cause is the failure to sanitize or encode the 'policy_name' parameter before it is rendered in the web interface. An attacker must be authenticated with 'WebCfg - Services: suricata package' permissions to exploit this flaw. By submitting a specially crafted string containing HTML or JavaScript, the payload is stored on the server and executed in the context of any user who subsequently views the affected page. This can lead to session hijacking or unauthorized configuration changes. The issue is addressed in Suricata package versions following 7.0.8_2 and pfSense CE 2.8.0 / Plus 25.07.
Affected products
- Netgate pfSense CE up to (excluding) 2.8.0
- Netgate pfSense Plus up to (excluding) 25.07
- Netgate Suricata package for pfSense <= 7.0.8_2
Timeline
- 2025-09-09: disclosed
- 2025-09-09: patched: Fix included in Suricata package update and pfSense CE 2.8.0/Plus 25.07 releases.
- 2025-09-09: advisory