pfSense

The page at status_graphs.php displays a table of hosts consuming bandwidth in real-time. Optionally, this table can resolve IP addresses to fully qualified domain names or use descriptions from DHCP static mappings or DNS host overrides for display. The values returned by the these lookups are not validated and are displayed without encoding.

These address lookups to return an XSS payload, which could result in XSS depending on the settings on the traffic graphs page.

There are multiple paths which can potentially trigger the problem, but not all of them are viable:

• When Display is set to FQDN:
  • Payload in a hostname directly in /etc/hosts -- Would have to be manually edited in, no way to set that in the GUI as it doesn't pass validation
  • Payload in a PTR record from DNS -- FreeBSD libraries filter out such invalid hostnames so they don't make it to the client

• When Display is set to Description:
  • Payload in DNS Resolver or DNS Forwarder Host Override descriptions -- Can be set by user and triggers the problem
  • Payload in DHCP Static Mapping descriptions -- Could work, but the functionality is broken, see #16979