Project

General

Profile

Actions
Copy link

Bug #16945

closed
JP JP

Potential XSS via URL Table Ports Alias content

Bug #16945: Potential XSS via URL Table Ports Alias content

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Aliases / Tables
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Comments imported with URL Table Aliases for Port content are retained and printed back to the user when an alias is used in a firewall rule (firewall_rules.php) or NAT rule (firewall_nat.php) as they both use the same helper function alias_info_popup() which prints that content without encoding.

To reproduce, first create a URL Table (Ports) type alias with a URL pointing to a location with a specially-crafted payload like the following:

#" onmouseover=alert(/XSS/.source) x=" 
80

Then use the resulting port alias in a firewall rule and/or a NAT rule. Then hover the mouse over the alias name in the rule list.

Files

16945.patch (545 Bytes) 16945.patch Jim Pingle, 07/10/2026 07:14 PM

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #2

Fixed in commit d6fb77d7bee97136433a155bf4987dca415770e8

Added encoding to the output.

Patch is attached.

GT Updated by Georgiy Tyutyunnik about 2 months ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

fixed in the latest dev
tested on:
26.07-BETA (amd64)
built on Fri Jul 17 15:34:00 UTC 2026
FreeBSD 16.0-CURRENT

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom