CVE-2022-29273

What it actually does

CVE-2022-29273 is a cross-site scripting vulnerability in the pfSense WebGUI affecting pfSense CE through 2.6.0 and pfSense Plus before 22.05. The flaw is associated with URL Table Alias URL parameters and allows attacker-controlled script content to be interpreted in the WebGUI context when a user interacts with a crafted URL or malicious alias-related input. Successful exploitation can let the attacker execute JavaScript as the victim’s browser session, potentially reading page content, abusing authenticated WebGUI actions, modifying firewall configuration through the victim’s privileges, or pivoting to additional administrative actions if the victim is a privileged pfSense user.

Why it matters to the business

If exploited against an administrator or other WebGUI user, this vulnerability can undermine trust in the firewall management interface and may allow unauthorized changes to firewall, NAT, alias, VPN, or user configuration through the victim’s session. Operational consequences may include weakened network access controls, service disruption from unintended policy changes, exposure of internal network information, and additional incident response effort to verify firewall integrity. Although it is not listed in CISA KEV and no ransomware use is indicated, the EPSS score is elevated, suggesting meaningful likelihood of exploitation activity relative to many vulnerabilities; affected internet-accessible or broadly reachable WebGUI deployments should be prioritized.

How an attack unfolds

An attacker first identifies an organization using a vulnerable pfSense WebGUI version or targets administrators likely to manage pfSense. The attacker then prepares a crafted WebGUI request or URL Table Alias-related value containing JavaScript payload syntax, often encoded to evade casual inspection. Because exploitation requires user interaction, the attacker typically delivers the malicious link through phishing, chat, ticketing systems, documentation comments, or another channel likely to be opened by a pfSense administrator. When the victim’s browser loads the vulnerable WebGUI page while authenticated, the application fails to safely neutralize the attacker-controlled parameter and the script executes in the WebGUI origin. From there, the attacker may attempt to issue authenticated requests through the victim’s session, inspect visible configuration data, create or alter aliases and firewall rules, add persistence through administrative configuration changes, or stage follow-on access.

How to fix it

Upgrade pfSense to a fixed release. pfSense Plus should be upgraded to 22.05 or later. pfSense CE installations affected through 2.6.0 should be upgraded to a release newer than 2.6.0 that contains the vendor fix. If immediate upgrade is not possible, restrict WebGUI access to a dedicated management network or VPN, block WebGUI exposure from the internet, require strong administrator authentication, reduce the number of users with WebGUI access, and warn administrators not to open untrusted pfSense WebGUI links. Review URL Table Alias entries and recent firewall configuration changes for unexpected script-like content or unauthorized modifications. Treat mitigations as temporary; input validation and output encoding fixes must come from the patched pfSense release.

How to confirm the fix worked

Confirm the installed pfSense version from the WebGUI dashboard or command line and verify it is pfSense Plus 22.05 or later, or pfSense CE newer than 2.6.0 with the vendor security fix applied. Confirm the WebGUI is not reachable from untrusted networks by scanning externally and from representative internal segments. Review configured URL Table Aliases for suspicious URL values, encoded script content, or unexpected changes. In a controlled test environment only, attempt a benign XSS validation payload against the affected URL Table Alias parameter and confirm the payload is rendered inert rather than executed. Validate that WebGUI access logs no longer show successful requests to vulnerable paths using script-like parameters after remediation.

Typical attack path

1. Identify a target running pfSense CE 2.6.0 or earlier, or pfSense Plus earlier than 22.05.
2. Craft a malicious URL or URL Table Alias parameter containing JavaScript or event-handler payload content.
3. Deliver the crafted link or content to a user who can access the pfSense WebGUI, preferably an administrator.
4. Victim opens the crafted content while authenticated to the WebGUI.
5. Malicious JavaScript executes in the browser under the pfSense WebGUI origin.
6. Attacker abuses the victim’s session context to view configuration data or submit configuration-changing requests.
7. Attacker attempts to persist access or weaken network controls by modifying aliases, firewall rules, users, VPN settings, or related configuration.

How to detect it

Look for evidence that a pfSense WebGUI user was lured into opening crafted alias-management URLs or that malicious URL Table Alias values were saved. Useful sources include pfSense WebGUI access logs, reverse proxy or WAF logs in front of the WebGUI, authentication logs, system logs, configuration backups, and the current pfSense configuration file. Review requests to alias-related WebGUI endpoints for raw or URL-encoded JavaScript indicators such as script tags, event handlers, JavaScript URI schemes, SVG/image error handlers, or suspicious encoded characters in query strings or POST bodies. Correlate suspicious requests with successful WebGUI logins, administrator source IPs, session activity, and subsequent configuration changes. Examine configuration history for unexpected edits shortly after suspicious requests, particularly aliases, URL Table Alias entries, firewall rules, NAT rules, users, VPN configuration, and package settings. Because generic XSS payloads vary widely, absence of a known payload string does not rule out exploitation; focus on abnormal script-like input combined with privileged WebGUI activity.

• /firewall_aliases.php
• /firewall_aliases_edit.php
• type=urltable
• %3Cscript
• <script
• %3C%2Fscript%3E
• </script>
• javascript:
• java%73cript%3A
• onerror=
• onload=
• onclick=
• %6F%6E%65%72%72%6F%72
• alert(
• document.cookie
• document.domain
• fetch(
• XMLHttpRequest
• %3Cimg
• <img
• %3Csvg
• <svg
• /cf/conf/config.xml

What your security team should do

• Prioritize upgrade of all pfSense CE 2.6.0 or earlier and pfSense Plus versions before 22.05, especially where the WebGUI is reachable from broad internal networks or the internet.
• Immediately restrict pfSense WebGUI access to trusted management networks or VPN-only access if not already enforced.
• Search historical WebGUI access logs for requests to alias-management pages containing script tags, JavaScript URI schemes, event-handler attributes, or encoded equivalents.
• Review pfSense configuration history for unexpected changes to aliases, firewall rules, NAT rules, users, VPN settings, package settings, and administrator accounts.
• Inspect URL Table Alias values in configuration backups and current configuration for suspicious script-like or encoded content.
• Educate firewall administrators to avoid opening unsolicited pfSense WebGUI links or links embedded in support tickets, email, and chat messages.
• If suspicious activity is found, rotate administrator credentials, invalidate active sessions where possible, preserve configuration backups and logs, and perform a full firewall configuration integrity review.