Abraxas Labs

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces wireless edit.php or interfaces assign.php, which interface wireless clone() interpolates unescaped into an ifconfig shell command.

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface ipalias configure() ifconfig calls or get carp interface status() when CARP status is rendered.

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete queue() passes the unquoted value to dnctl via /bin/sh as root.

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services pppoe edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces ppps edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn l2tp.php or services pppoe edit.php, appending an up-script that executes as root when a session starts.

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto prepend file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services unbound acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services unbound advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock queue timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services captiveportal hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected users with shell metacharacters in ip or mac fields, which captiveportal load pfctl passes unescaped to a pfctl shell command.

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services dyndns edit.php. Attackers can set a non-matching Result Match string so checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

**Name of the Vulnerable Software and Affected Versions** Netgate pfSense CE versions prior to 2.9.0 **Description** An authorization bypass exists that allows read-only WebGUI users to replace the `config.xml` file. This occurs because the `config restore()` and `config install()` functions ignore the `User - Config: Deny Config Write` privilege. Attackers with page privileges for the endpoints 'services acb.php', 'uploadconfig.php', 'diag confbak.php', or 'diag backup.php' can install a custom `config.xml` to achieve root-level code execution following a reload or reboot. **Recommendations** Update Netgate pfSense CE to version 2.9.0 or later. Restrict access to the endpoints 'services acb.php', 'uploadconfig.php', 'diag confbak.php', and 'diag backup.php' for users with read-only privileges.

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.