CVE-2023-42327

What it actually does

This is a cross-site scripting vulnerability in the Netgate pfSense web interface, specifically associated with crafted requests to getserviceproviders.php in pfSense 2.7.0. A low-privileged authenticated attacker can craft a URL that, when opened by another authenticated user, causes attacker-controlled JavaScript to execute in that user’s browser under the pfSense management interface origin. Because the script runs with the victim’s web-session privileges, it may read page content, capture anti-CSRF tokens, perform actions through the UI, or modify settings within the limits of the victim’s privileges, enabling privilege escalation when the victim is an administrator.

Why it matters to the business

Successful exploitation can let an attacker turn a phishing-style link into unauthorized administrative actions on a firewall or network security appliance. That can result in configuration changes, exposure of sensitive network or VPN information, weakening of firewall controls, or creation of persistence through new accounts or altered settings. Although this vulnerability is not listed in CISA KEV and is not known to be ransomware-associated, public exploit availability and a high EPSS score indicate meaningful exploitation likelihood, especially where pfSense administrative interfaces are reachable by untrusted users. The provided package metadata also lists ffmpeg packages for Debian and Ubuntu; because that does not align with the pfSense XSS description, teams should validate advisory-to-asset mapping before closing remediation work.

How an attack unfolds

An attacker first obtains or already has low-privileged access to the pfSense web interface, or otherwise has enough access to craft a valid request path targeting getserviceproviders.php. The attacker creates a URL containing JavaScript payload syntax in a vulnerable parameter. The attacker then induces a higher-privileged pfSense user, commonly an administrator, to open the URL while authenticated to the management interface. The victim’s browser submits the request and renders the vulnerable page. Because the application fails to safely encode the attacker-controlled input, the browser executes the injected script in the trusted pfSense interface context. The script can then issue authenticated requests, read accessible page data, harvest tokens, or perform configuration changes as the victim, potentially allowing privilege escalation or unauthorized changes to firewall and VPN settings.

How to fix it

Upgrade affected pfSense installations from version 2.7.0 to a vendor-fixed release or apply the relevant Netgate security update that corrects input validation and output encoding for getserviceproviders.php. Restrict access to the pfSense web configurator to trusted administrative networks or VPN-only access, and avoid exposing it to the internet. Enforce MFA for administrative users where supported, limit low-privileged UI access, and use role-based access controls to reduce the blast radius of UI-based attacks. As compensating controls, block or alert on suspicious requests to /getserviceproviders.php containing script syntax or URL-encoded HTML/JavaScript. The supplied fixed-version metadata lists unrelated ffmpeg packages: Debian 13 ffmpeg fixed in 7:7.0.1-3 and Ubuntu Pro 24.04 LTS ffmpeg fixed in 7:6.1.1-3ubuntu5+esm1. If asset scanners flag those packages, upgrade to those versions, but verify whether that finding is correctly associated with this CVE because the vulnerability description identifies pfSense XSS rather than ffmpeg.

How to confirm the fix worked

Confirm whether any pfSense web interface is running version 2.7.0 and whether the web configurator is reachable from untrusted networks. After remediation, verify the installed pfSense version is a vendor-fixed release and that requests to getserviceproviders.php no longer reflect untrusted input as executable HTML or JavaScript. Test with a harmless XSS probe such as a URL-encoded script marker and confirm it is rejected, escaped, or rendered inert. Review network controls to ensure administrative access is limited to trusted sources. For package-management validation where the provided ffmpeg metadata is applicable, confirm Debian 13 systems have ffmpeg version 7:7.0.1-3 or later and Ubuntu Pro 24.04 LTS systems have ffmpeg version 7:6.1.1-3ubuntu5+esm1 or later.

Typical attack path

1. Identify an exposed or internally reachable pfSense 2.7.0 management interface.
2. Authenticate with a low-privileged account or otherwise identify the vulnerable getserviceproviders.php request pattern.
3. Craft a malicious URL containing an XSS payload in a parameter processed by getserviceproviders.php.
4. Deliver the URL to a higher-privileged authenticated pfSense user through email, chat, ticket comments, documentation links, or another social-engineering channel.
5. When the victim opens the link, execute JavaScript in the victim’s browser under the pfSense web interface origin.
6. Use the victim’s session and anti-CSRF tokens to issue privileged web requests or extract sensitive information available in the UI.
7. Modify configuration, create or alter users, weaken security controls, or otherwise gain elevated control consistent with the victim’s privileges.

How to detect it

To determine whether exploitation already occurred, review pfSense web server/access logs, reverse proxy logs, VPN/admin access logs, firewall management audit logs, and authentication records. Focus on requests to /getserviceproviders.php with suspicious query strings containing HTML tags, URL-encoded angle brackets, JavaScript event handlers, javascript: URIs, token names, or external callback URLs. Correlate suspicious requests with the user account, source IP, user-agent, and subsequent administrative actions in the same session. Look for configuration changes shortly after the request, including new or modified users, privilege changes, firewall/NAT/VPN rule changes, altered DNS or gateway settings, modified certificate or package settings, and unexpected downloads or exports. Because XSS execution occurs in the victim’s browser, endpoint browser history, proxy logs, DNS logs, and EDR telemetry may show outbound connections to attacker-controlled domains embedded in the payload. If exploitation is suspected, invalidate active sessions, rotate affected administrator credentials, review configuration backups for unauthorized changes, and compare running configuration against a known-good baseline.

• /getserviceproviders.php
• getserviceproviders.php?
• %3Cscript
• <script
• %3C%2Fscript%3E
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• document.cookie
• document.domain
• localStorage
• sessionStorage
• XMLHttpRequest
• fetch(
• csrfMagicToken
• %3Cimg
• %3Csvg
• %22%3E%3Cscript
• '><script
• "><script

What your security team should do

• Prioritize inventory validation because the vulnerability description and affected-product metadata conflict; confirm whether the exposure is pfSense 2.7.0, ffmpeg packages, or both due to scanner/advisory mapping error.
• Upgrade pfSense 2.7.0 systems to a fixed Netgate release and separately apply the listed ffmpeg package updates where those packages are actually present and relevant.
• Restrict pfSense web configurator access to dedicated administrative networks or VPN access only; do not allow broad internet or general user-network access.
• Search historical web access logs for suspicious requests to /getserviceproviders.php containing encoded script tags, event handlers, javascript: URIs, or token-harvesting terms.
• Review pfSense administrative audit logs for unexpected configuration changes, account creation, privilege changes, VPN/firewall rule changes, or logins around suspicious request times.
• Educate administrators not to open unsolicited links to management interfaces and require re-authentication/MFA for sensitive administrative workflows where possible.
• Add SIEM detections or WAF rules for XSS payload patterns targeting getserviceproviders.php.