Description

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-19T20:17:20.740Z",
  "pubdate": "2026-08-19T20:17:20.740Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists in pfSense Plus before 26.07 and pfSense CE through 2.8.1.\nThe vulnerability resides in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are embedded directly into AJAX responses without input sanitization.\nAn external attacker capable of controlling a PTR record and generating sufficient network traffic to appear in the top-talker statistics can force the administrator interface to render malicious JavaScript.\nSuccessful exploitation allows the execution of arbitrary JavaScript within the context of an authenticated administrator's browser session.\nThis grants the attacker same-origin access to the firewall management interface, enabling critical post-exploitation actions such as administrative account creation and arbitrary operating system command execution.\nThe risk implication is severe, as it bridges external network exposure with full administrative compromise of the firewall appliance through browser-based exploitation.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper input sanitization and output encoding of untrusted data derived from network operations.\nSpecifically, the Traffic Graphs top-talkers feature performs reverse DNS lookups to resolve IP addresses into hostnames using PTR records.\nThese PTR records are subsequently incorporated into AJAX responses without being sanitized.\nWhen an administrator views the Traffic Graphs feature, the returned PTR records are rendered as HTML through a DOM sink within the administrator interface.\nThe affected component is the Traffic Graphs top-talkers feature in the administrator interface of pfSense Plus before 26.07 and pfSense CE through 2.8.1.\nThe attack flow proceeds as follows: First, an attacker establishes control over a PTR record associated with an IP address that they control. Second, the attacker generates sufficient network traffic directed at or through the target pfSense firewall to ensure that their IP address appears within the top-talkers statistics feature. Third, when an authenticated administrator navigates to the Traffic Graphs section of the management interface, the firewall initiates a reverse DNS lookup for the attacker's IP address, retrieving the malicious payload embedded within the PTR record. Fourth, the firewall incorporates this unsanitized PTR record into the AJAX response. Fifth, the client-side browser processes the response and passes the data into a DOM sink, causing the execution of arbitrary JavaScript payload within the authenticated administrator's browser session.\nAuthentication and privilege requirements for the target context rely on an administrator being logged into the management interface to view the vulnerable page, while the attacker requires no prior authentication to the firewall but must control network traffic and DNS infrastructure.\nThe payload behavior executes within the security context of the victim administrator, inheriting full session privileges.\nThe post-exploitation impact includes full administrative compromise of the firewall management interface, allowing the attacker to create new administrative accounts and execute arbitrary OS commands on the underlying operating system."
}