Description

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T15:17:30.630Z",
  "pubdate": "2026-09-03T15:17:30.630Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in pfSense Plus and pfSense CE.\nThe vulnerability originates from improper input sanitization of configuration parameters in /status_monitoring.php, which allows authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript payloads.\nThese malicious scripts are subsequently persisted within the global pfSense XML configuration file.\nThe primary impact is the execution of arbitrary JavaScript code within the context of any user session that navigates to the affected monitoring page, leading to potential session hijacking, unauthorized actions performed on behalf of legitimate users, or internal data exfiltration.\nAffected products include pfSense Plus before version 26.07 and pfSense CE before version 2.9.0.\nSuccessful exploitation requires the attacker to possess authenticated access to the management interface with the specific 'Status: Monitoring' privilege.\nBecause the payload is stored globally, the vulnerability poses a significant risk to administrative account security and overall appliance integrity, as the XSS is triggered automatically upon rendering the monitoring dashboard.",
  "technicalDetails": "The vulnerability resides in the handling of HTTP POST parameters directed at /status_monitoring.php. The application fails to implement adequate input validation or output encoding for several critical parameters, including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval.\nThe root cause is the direct concatenation of these unsanitized user-supplied inputs into the global pfSense XML configuration file. This configuration file acts as the single source of truth for system settings, meaning any injected payload is permanently stored and re-loaded upon subsequent system or service operations.\nWhen a user navigates to the Status: Monitoring page, the application retrieves these malicious configuration values and echoes them directly into a JavaScript string context during the page rendering process. Because the server-side code fails to implement proper context-aware output encoding (such as escaping characters relevant to JavaScript or HTML), the browser interprets the injected strings as executable code rather than plain text.\nThe attack flow proceeds as follows: 1) An attacker with the 'Status: Monitoring' privilege submits a POST request to /status_monitoring.php containing a malicious JavaScript payload injected into one of the vulnerable parameters. 2) The pfSense backend processes the request and writes the payload into the global XML configuration file without sanitization. 3) Any subsequent user (including administrators) who accesses the /status_monitoring.php page triggers the browser to execute the stored payload. 4) The injected script runs within the origin of the pfSense management interface, inheriting the victim's session permissions.\nSince the payload is persisted in the global configuration, it remains active until the configuration is manually corrected or overwritten, ensuring continuous execution for all visitors to the dashboard. The post-exploitation impact includes the ability to perform CSRF-like attacks, steal session cookies if HttpOnly flags are missing, modify appliance settings, or redirect users to malicious external domains. This vulnerability effectively allows for privilege escalation if a lower-privileged user can successfully execute a script in the browser of a higher-privileged administrative user."
}