Description

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T15:17:30.953Z",
  "pubdate": "2026-09-03T15:17:30.953Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw affecting pfSense Plus before version 26.07 and pfSense CE before 2.9.0. The vulnerability resides within the schedule description field of the firewall configuration interface.\nAn authenticated user possessing the 'Firewall: Schedules: Edit' privilege can inject malicious JavaScript into the system by crafting a payload for the 'descr' parameter within 'firewall_schedule_edit.php'. Because the application fails to properly sanitize this input before storage and employs insufficient escaping when rendering the data, an attacker can achieve code execution within the browser context of other administrators.\nThe vulnerability poses a significant risk to administrative integrity. By targeting users with the 'Firewall: Rules' privilege, an attacker can execute arbitrary scripts whenever a victim navigates to 'firewall_rules.php' to view affected firewall schedules. This allows for potential session hijacking, unauthorized configuration changes, or the performance of administrative actions on behalf of the victim, thereby compromising the security boundary of the firewall management interface.",
  "technicalDetails": "The vulnerability is primarily a result of improper output encoding and a lack of server-side sanitization in the handling of user-supplied data. Specifically, the 'descr' parameter in 'firewall_schedule_edit.php' accepts arbitrary text for schedule descriptions, which is then stored in the firewall configuration database without sanitization against HTML or JavaScript injection.\nThe exploitation vector is facilitated by the improper handling of this data when it is retrieved and rendered in 'firewall_rules.php'. When the firewall rules interface generates the HTML required to display schedule details, it embeds the stored description into an HTML attribute value. While the application implements a single-quote escaping mechanism, it fails to account for double-quote characters. This discrepancy allows an attacker to perform a double-quote breakout, escaping the intended attribute context and facilitating the injection of arbitrary HTML and JavaScript tags.\nThe attack flow proceeds as follows: First, the attacker, authenticated with 'Firewall: Schedules: Edit' privileges, submits a malicious payload via the 'descr' parameter in 'firewall_schedule_edit.php'. A typical payload would utilize a double-quote to terminate the current attribute, followed by an 'onmouseover' event handler or a standard '<script>' tag to execute malicious code. Once saved, this payload persists in the backend configuration file.\nThe second stage of the attack is passive and triggered by the victim. When a user with the 'Firewall: Rules' privilege accesses 'firewall_rules.php', the vulnerable code retrieves the malicious description from the configuration database. Because the rendering logic in 'firewall_rules.php' only addresses single-quote characters, the malicious double-quote-escaped payload is rendered directly into the Document Object Model (DOM).\nUpon successful injection, the browser interprets the script as legitimate content within the context of the pfSense administrative session. This results in the execution of the injected JavaScript within the victim's browser session. Consequently, the attacker can leverage the victim's established session to perform unauthorized actions or exfiltrate sensitive data, as the script operates with the security context and permissions of the logged-in administrator."
}