IPFire Firewall Admin Panel Vulnerability Enables Persistent JavaScript Injection

A critical vulnerability in IPFire’s 2.29 web-based firewall interface (firewall.cgi) allows authenticated administrators to inject persistent JavaScript code, potentially enabling session hijacking, unauthorized actions, or internal network pivoting. Tracked as CVE-2025-50975, the stored XSS flaw stems from improper sanitisation of several rule parameters in the firewall rule editor, including fields such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr.

An attacker with high-privilege GUI access can embed malicious JavaScript payloads into these parameters, with execution occurring whenever any administrator views the firewall rules page. The article notes that exploitation is straightforward and requires only valid administrator credentials with GUI access, and a GIF proof-of-concept is hosted on GitHub.

Mitigations include updating IPFire beyond version 2.29, restricting admin access, enforcing multi-factor authentication, deploying a strict Content Security Policy, and auditing firewall rules. This information was reported, according to GBHackers On Security, on 27 August 2025.