CVE-2025-34172: Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting
In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pfSense CE HAProxy Packageto a version that resolves this vulnerability.Fixed in 0.63_10 - Configuration
In /usr/local/www/haproxy/haproxy_stats.php, ensure the value of the showsticktablecontent parameter (read from HTTP GET requests) is encoded/escaped (and validated if applicable) before rendering it into the page to prevent reflected cross-site scripting for authenticated users.
pfSense CE /usr/local/www/haproxy/haproxy_stats.php showsticktablecontent (derived from HTTP GET parameter) = Output should be properly encoded/validated before being displayed
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34172?
CVE-2025-34172 has a severity rating that indicates a potential risk for reflected cross-site scripting in authenticated users.
How do I fix CVE-2025-34172?
To mitigate CVE-2025-34172, ensure you update to the latest version of the pfSense CE HAProxy Package where the vulnerability is addressed.
Who is affected by CVE-2025-34172?
CVE-2025-34172 affects users of the pfSense CE HAProxy Package who authenticate to the system.
What type of vulnerability is CVE-2025-34172?
CVE-2025-34172 is categorized as a reflected cross-site scripting vulnerability.
Is CVE-2025-34172 likely to be exploited?
Given that CVE-2025-34172 targets authenticated users, it has the potential to be exploited if proper mitigations are not applied.