CVE-2019-8953: pfSense HAProxy package stored XSS via listener description and ACL parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw is a medium-severity stored XSS requiring user interaction, but it affects a security appliance's admin interface and public exploit code exists with very high EPSS, so it warrants prompt patching rather than emergency action.

What it is

The HAProxy package before 0.59_16 for pfSense fails to sanitize the desc (Description) and table_actionsaclN parameters handled by haproxy_listeners.php and haproxy_listeners_edit.php, allowing cross-site scripting. Because the injected content is stored in the firewall's HAProxy configuration, it can execute in the browser of any administrator who views the affected listener pages, which matters for a security appliance whose UI holds privileged configuration.

Impact

An attacker can run script in an authenticated administrator's browser session on the pfSense webGUI, enabling session theft, credential capture, or unauthorized configuration changes performed as that admin. The CVSS vector scores only low confidentiality and integrity impact, so the direct blast radius is limited to the victim's session and actions reachable through it.

Attack surface

Reached over the network through the pfSense webGUI pages haproxy_listeners.php and haproxy_listeners_edit.php; the CVSS vector is AV:N/AC:L/PR:N/UI:R, so no prior authentication is required to deliver the payload but a victim user must interact with the crafted page or link. The description does not state whether the malicious input itself requires an authenticated HAProxy configuration session.

Exploitation

Not listed in CISA KEV, but EPSS is 0.52236 (99th percentile) and references include Exploit-DB 46538 and a cxsecurity advisory tagged Exploit, indicating public proof-of-concept code exists. No ransomware group usage is documented.

What to do

• Upgrade the pfSense HAProxy package to 0.59_16 or later; the referenced FreeBSD-ports commits and Redmine issue 9335 contain the fix.
• If immediate upgrade is not possible, restrict webGUI access to trusted management networks and avoid opening untrusted links while logged in.
• Enforce short admin session lifetimes and re-authentication for configuration changes to limit the value of a hijacked session.
• Review HAProxy listener descriptions and ACL entries for unexpected HTML or script content and remove anything suspicious.

Detection

• Search HAProxy listener configuration and ACL fields for stored HTML or script tags, especially in desc and table_actionsaclN values.
• Monitor web server and pfSense logs for requests to haproxy_listeners.php or haproxy_listeners_edit.php containing script-like parameters.
• Alert on administrator sessions that change HAProxy settings shortly after visiting external or untrusted pages.
• Use the public Exploit-DB 46538 payload as a test case to validate detection coverage against the affected pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.