CVE-2025-34173
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In pfSense CE, the file /usr/local/www/snort/snort_ip_reputation.php does not sanitize the iplist parameter for directory traversal characters before checking file existence. Although file contents are not disclosed, the server reveals whether a file exists, enabling an attacker to enumerate files on the target. The attacker must be authenticated with at least 'WebCfg - Services: Snort package' permissions.
Risk Assessment
The risk is that an authenticated attacker can enumerate files on the server, potentially revealing the presence of sensitive configuration files or other resources, which could facilitate further attacks.
Recommendation
Update pfSense CE to the latest version containing the security fix, or manually sanitize the iplist parameter for directory traversal characters (e.g., '../') in the source code.
Other vulnerabilities in pfSense CE
See all- CVE-2025-34176Medium
In pfSense CE, the suricata/suricata_ip_reputation.php file does not sanitize the iplist parameter against directory traversal sequences. This value is directly used in a file existence check, allowing an authenticated attacker to enumerate files on the server.
- CVE-2025-34175Medium
In pfSense CE, the file /usr/local/www/suricata/suricata_filecheck.php directly displays the value of the filehash parameter without sanitizing HTML-related characters/strings. This can result in reflected cross-site scripting (XSS) if the victim is authenticated.
- CVE-2025-34178Medium
In pfSense CE, in the file suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting (XSS). The attacker must be authenticated with at least 'WebCfg - Services: suricata package' permissions.
- CVE-2025-34177Medium
In pfSense CE, in the file suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting (XSS). The attacker must be authenticated with at least 'WebCfg - Services: suricata package' permissions.
- CVE-2025-34172Medium
In pfSense CE, the value of the showsticktablecontent parameter in /usr/local/www/haproxy/haproxy_stats.php is displayed after being read from HTTP GET requests. This enables reflected cross-site scripting when the victim is authenticated.
Original NVD description (English source)
In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions.