Project

General

Profile

Actions
Copy link

Bug #16924

closed
JP JP

Potential stored XSS via Firewall Schedules

Bug #16924: Potential stored XSS via Firewall Schedules

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Rules / NAT
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Firewall rule schedule descriptions are printed without sufficient encoding on firewall_rules.php when the schedule is in use.

The page escapes single quotes in the description, but an XSS payload using double quotes is not escaped.

Files

16924.patch (1.38 KB) 16924.patch Jim Pingle, 07/01/2026 07:30 PM

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #1

Fixed by commit b20191f85405a218d996171c8a0199d35f101c6a

Corrected encoding of the schedule description and cleaned up a single-use variable.

Patch is attached.

GT Updated by Georgiy Tyutyunnik about 2 months ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

fixed in the latest dev
Tested on:
26.07-BETA (amd64)
built on Fri Jul 17 15:34:00 UTC 2026
FreeBSD 16.0-CURRENT

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom