CVE-2019-8953

published 2019-02-20

CVE-2019-8953: The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and…

Priority P3 52 medium 6.1 CVSS 3.0

AV N AC L PR N UI R S C C L I L A N

EXPLOIT

The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
netgate	haproxy	< 0.59_16	0.59_16

Detection & IOCs extracted from sources · hover to see the quote

url https://192.168.1.1/haproxy/haproxy_listeners_edit.php↗

command ">alert("test")↗

• → Monitor POST/GET requests to haproxy_listeners.php and haproxy_listeners_edit.php for XSS payloads in the 'desc' (Description) or 'table_actionsaclN' parameters. ↗
• → The vulnerability is stored/persistent XSS — inspect stored HAProxy listener configurations for injected script content in the Description field. ↗
• → Target endpoint for exploitation is /haproxy/haproxy_listeners_edit.php; alert on unexpected script tags or event handler strings in the PARAMETER 'Description' field. ↗

• · Vulnerability affects HAProxy package versions before 0.59_16 on pfSense; the exploit was demonstrated on pfSense 2.4.4-p1 with HAProxy package 0.59_14. ↗

CVSS provenance

nvd v3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79