pfSense » pfSense Packages

When Zeek is active, it records a variety of information in its logs, including the user agent string of HTTP requests to the web server on the firewall itself. The Real Time Inspection page at zeek_alerts.php displays these logs by fetching log data using zeek_alert_data.php, which assembles them into an HTML table but does not encode the content.

If a user submits a request to the web server using a specially-crafted user agent string, that user agent could be displayed to an administrator monitoring the Zeek log files (e.g. software.log, http.log, etc.), leading to a potential XSS.

Example request:

curl -k --user-agent "<iframe/onload=alert('ZeekXSS')>" http://192.168.1.1/thisdoesnotexist

There are several other log-related bugs in the Zeek package which prevent the Real Time Inspection page from working properly on current Plus versions of the package.

Reported by: @lujiefsi