pfSense CE vulnerabilities

In pfSense CE, the suricata/suricata_ip_reputation.php file does not sanitize the iplist parameter against directory traversal sequences. This value is directly used in a file existence check, allowing an authenticated attacker to enumerate files on the server.

In pfSense CE, the file /usr/local/www/suricata/suricata_filecheck.php directly displays the value of the filehash parameter without sanitizing HTML-related characters/strings. This can result in reflected cross-site scripting (XSS) if the victim is authenticated.

In pfSense CE, in the file suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting (XSS). The attacker must be authenticated with at least 'WebCfg - Services: suricata package' permissions.

In pfSense CE, in the file suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting (XSS). The attacker must be authenticated with at least 'WebCfg - Services: suricata package' permissions.

In pfSense CE, the file /usr/local/www/snort/snort_ip_reputation.php does not sanitize the iplist parameter for directory traversal characters before checking file existence. Although file contents are not disclosed, the server reveals whether a file exists, enabling an attacker to enumerate files on the target. The attacker must be authenticated with at least 'WebCfg - Services: Snort package' permissions.

In pfSense CE, the value of the showsticktablecontent parameter in /usr/local/www/haproxy/haproxy_stats.php is displayed after being read from HTTP GET requests. This enables reflected cross-site scripting when the victim is authenticated.