Description
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected products
- Netgate / pfSense CE2.5.0 – 2.9.0
- pfSense / pfsense2.5.0 – 2.9.0
References
- MISChttps://github.com/abraxas/pfsense-ovpn-learn-cn
- MISChttps://abraxaslabs.tech/research/pfsense-ce-leftovers
- MISChttps://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.learn-address.sh#L57-L62
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/netgate-pfsense-ce-2.5.0-through-2.9.0-os-command-injection-via-openvpn-learn-address-sh
Updated 19m ago · 8 sources