Description
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
High
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Netgate / pfSense CE2.4.5 – 2.9.0
References
- MISChttps://github.com/abraxas/pfsense-sshguard-crlf
- MISChttps://abraxaslabs.tech/research/pfsense-ce-leftovers
- MISChttps://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381
- MISChttps://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php
Updated 19m ago · 8 sources