pfBlockerNG Stored XSS to RCE via Unsanitized DNS Reply Log Data

CVE-2026-78902 is a stored cross-site scripting flaw in pfBlockerNG (versions prior to 3.2.16_1) that chains to unauthenticated remote code execution as root on the underlying pfSense firewall. When Unbound Python mode with DNS Reply Logging is active — the default logging behavior when Python mode is configured — pfBlockerNG writes raw DNS reply data, including attacker-controlled TXT record content, into /var/log/pfblockerng/dns_reply.log and /var/log/pfblockerng/unified.log without sanitization. A crafted DNS reply containing JavaScript persists in these logs and surfaces on the aggregated Stats page, surviving the 200-row DNS Reply table rotation. When an administrator views the pfBlockerNG Alerts or Stats page in the webConfigurator, the payload fires in their browser, fetches /diag_command.php to steal a CSRF token, and executes arbitrary OS commands as root. Affected: pfBlockerNG < 3.2.16_1 on all pfSense CE and pfSense Plus releases.

No vendor CVSS score exists for this CVE. Noisgate calculates the CVSS 3.1 base at 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) — network-reachable, zero authentication, scope change from browser to operating system, full confidentiality/integrity/availability impact. The only attacker constraint is user interaction: an admin must view a pfBlockerNG dashboard page. This is a routine action for any pfBlockerNG operator. pfSense is canonically a network edge appliance — it IS the perimeter firewall — and pfBlockerNG is one of the most popular packages in the ecosystem with DNS Reply Logging enabled by default in Python mode. Root compromise of the perimeter firewall is not a single-host event; it is a network-wide catastrophe. Noisgate assesses this at CRITICAL (9.1), reflecting minor friction from the user-interaction timing dependency while respecting the network-edge role floor.

1. Update pfBlockerNG to v3.2.16_1 immediately — This is the definitive fix. The patched version sanitizes DNS reply data before writing to logs, eliminating the injection vector. Available now via System → Package Manager → Installed Packages. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Per the noisgate remediation SLA, complete fleet-wide patching within 90 days.
2. Disable DNS Reply Logging NOW as interim mitigation — If you cannot update within hours, navigate to Firewall → pfBlockerNG → DNSBL → DNS Reply Logging and disable it. This eliminates the log-poisoning attack surface entirely. DNS-based blocking continues to function — you only lose per-reply telemetry. Apply within hours as a same-day compensating control.
3. Audit pfBlockerNG logs for injected payloads — Run grep -riE '<script|javascript:|onerror=|onload=|eval\(' /var/log/pfblockerng/*.log on every pfSense box. If matches are found, treat the firewall as compromised — initiate incident response, capture forensic images, rotate all credentials accessible from that network segment, and rebuild the pfSense box from clean media.
4. Restrict webConfigurator to a dedicated management VLAN — Bind the webConfigurator to a management-only interface per Netgate best practices. This does not prevent the XSS (the attack arrives via DNS, not HTTP), but limits which networks an admin session can originate from and reduces the probability of a compromised workstation being used for pfSense administration.
5. Monitor outbound connections from the pfSense management IP — A successful exploit spawns a reverse shell from the firewall. Configure upstream monitoring (SIEM, flow data, or an out-of-band tap) to alert on unexpected outbound TCP connections originating from pfSense management IPs to external destinations. Since a compromised firewall can suppress its own logs, out-of-band monitoring is critical.

Run this script on the pfSense appliance itself via SSH or the pfSense console shell (option 8). Requires root privileges (standard for pfSense shell access). Invoke with: sh /tmp/check_cve_2026_78902.sh

#!/bin/sh
# CVE-2026-78902 — pfBlockerNG Stored XSS to RCE via DNS Reply Log Poisoning
# Target: pfSense appliance (FreeBSD)
# Requires: root shell access
# Outputs: VULNERABLE / PATCHED / UNKNOWN

FIXED_VERSION="3.2.16_1"
FOUND=0
VULN=0

echo "=== CVE-2026-78902 Check ==="
echo ""

# Try both package name variants
for PKG in pfSense-pkg-pfBlockerNG-devel pfSense-pkg-pfBlockerNG; do
  INSTALLED=$(pkg query '%v' "$PKG" 2>/dev/null)
  if [ -n "$INSTALLED" ]; then
    FOUND=1
    echo "[*] Package: $PKG"
    echo "[*] Installed version: $INSTALLED"
    echo "[*] Fixed version:     $FIXED_VERSION"
    echo ""

    # Compare versions using FreeBSD pkg version
    CMP=$(pkg version -t "$INSTALLED" "$FIXED_VERSION" 2>/dev/null)
    if [ "$CMP" = "<" ]; then
      VULN=1
    fi
    break
  fi
done

if [ "$FOUND" -eq 0 ]; then
  echo "UNKNOWN — pfBlockerNG is not installed."
  echo "This CVE does not apply if pfBlockerNG is not in use."
  exit 2
fi

# Check DNS Reply Logging status
DNS_REPLY_LOG="/var/log/pfblockerng/dns_reply.log"
if [ -f "$DNS_REPLY_LOG" ]; then
  echo "[!] DNS Reply Log exists — logging is likely ACTIVE (attack surface present)."
  # Scan for evidence of exploitation
  SUSPICIOUS=$(grep -ciE '<script|javascript:|onerror=|onload=|eval\(|document\.cookie|fetch\(' "$DNS_REPLY_LOG" 2>/dev/null)
  if [ "$SUSPICIOUS" -gt 0 ]; then
    echo "[!!!] ALERT: $SUSPICIOUS suspicious line(s) found in DNS reply log!"
    echo "[!!!] Possible exploitation attempt. Investigate IMMEDIATELY."
    echo "[!!!] Run: grep -iE '<script|javascript:|onerror=' $DNS_REPLY_LOG"
  else
    echo "[+] No obvious XSS payloads found in DNS reply log."
  fi
else
  echo "[+] DNS Reply Log not found — logging may be disabled (reduced risk)."
fi

echo ""

# Final verdict
if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE — pfBlockerNG $INSTALLED is below fixed version $FIXED_VERSION."
  echo "ACTION: Update via System > Package Manager > Installed Packages."
  echo "INTERIM: Disable DNS Reply Logging in Firewall > pfBlockerNG > DNSBL."
  exit 1
else
  echo "PATCHED — pfBlockerNG $INSTALLED is at or above fixed version $FIXED_VERSION."
  exit 0
fi

1. NetSPI CVE-2026-78902 Full Writeup & PoC
2. pfSense Bugtracker — pfBlockerNG Stored XSS (Issue #16932)
3. Netgate Security Advisory pfSense-SA-26_08
4. Netgate Security Advisories Index
5. Netgate Forum — pfBlockerNG Unbound Python Mode
6. BleepingComputer — pfSense Shodan Exposure Analysis
7. Netgate WebConfigurator Access Restriction Guide
8. CISA Known Exploited Vulnerabilities Catalog