pfsense 2.3.2 Cross Site Request Forgery

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: pfsense 2.3.2  
Fixed in: 2.3.3  
Fixed Version Link: https://pfsense.org/download/  
Vendor Website: https://www.pfsense.org/  
Vulnerability Type: CSRF  
Remote Exploitable: Yes  
Reported to vendor: 02/06/2017  
Disclosed to public: 03/24/2017  
Release mode: Coordinated Release  
CVE: requested via DWF  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
pfsense is an open source firewall. The web interface is written in PHP. In  
version 2.3.2-RELEASE (amd64), the actions of creating and deleting firewall  
rules are vulnerable to CSRF, enabling an Attacker to edit these rules with a  
little bit of social engineering.  
  
3. Details  
  
CVSS: Medium; 5.4 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/  
PR:N/UI:R/S:U/C:N/I:L/A:L  
  
Description: The easyrule.php script is vulnerable to CSRF, which allows an  
attacker to create or delete firewall rules via CSRF.  
  
Proof of Concept:  
  
GET /easyrule.php?action=pass&int=LAN&proto=any&src=192.168.1.1&dst=192.168.1.1  
&dstport=80&ipproto=inet  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 2.3.3:  
  
https://pfsense.org/download/  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
02/06/2017 Informed Vendor about Issue  
02/07/2017 Vendor confirms + fixes issues in git  
02/20/2017 Vendor relases fix + vendor advisory  
03/24/2017 Disclosed to public  
  
  
Blog Reference:  
https://www.curesec.com/blog/article/blog/pfsense-232-CSRF-198.html  
  
--  
blog: https://www.curesec.com/blog  
Atom Feed: https://www.curesec.com/blog/feed.xml  
RSS Feed: https://www.curesec.com/blog/rss.xml  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany  
  
  
`