pfsense-voucher-expire-sqli

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-voucher-expire-sqli pfsense-voucher-expire-sqli Class: SQLi Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org voucher.inc captiveportalreaddb"WHERE username = '$voucher'" then first-row sessioni...

pfsense-unbound-acl-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-unbound-acl-crlf pfsense-unbound-acl-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org ACL name/action go into accesslists.conf with no checkconf. Same include: class as...

pfsense-logs-filter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-logs-filter-xss pfsense-logs-filter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org statuslogsfilter.php POST resolve= jsonencode with no JSONHEXTAG and default Content-Type...

pfsense-igmp-type

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-igmp-type pfsense-igmp-type Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicesigmpproxyedit.php stores POST type with no enum check. configure interpolates phyint...

pfsense-qinq-parent-if

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-qinq-parent-if Write-up: https://abraxaslabs.tech/research/pfsense-qinq-parent-if pfsense-qinq-parent-if Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org QinQ edit stores a parent...

pfsense-cp-maxprocperip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-maxprocperip pfsense-cp-maxprocperip Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Integer check is on unused POST maxproc. maxprocperip is stored raw and emitted ...

pfsense-crash-reporter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-crash-reporter-xss pfsense-crash-reporter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org /tmp/PHPerrors.log goes through htmlspecialchars. /var/crash/ is filegetcontents into...

pfsense-cp-filemanager-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-filemanager-write pfsense-cp-filemanager-write Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Upload name is not basename. A name that already contains captiveportal- ski...

opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 Write-up: https://abraxaslabs.tech/research/opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.or...

pfsense-acb-restore-priv

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-acb-restore-priv pfsense-acb-restore-priv Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org newver downloads, decrypts with the stored ACB password, configrestore...

opnsense-lockout-factory-ip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-lockout-factory-ip Write-up: https://abraxaslabs.tech/research/opnsense-lockout-factory-ip opnsense-lockout-factory-ip Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Unau...

pfsense-rss-body-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rss-body-xss pfsense-rss-body-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org 2604 encodes the title. Body is striptags only. Permalink is raw href. | ---|--- ID| no CVE yet...

pfsense-rules-if-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rules-if-xss pfsense-rules-if-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org firewallrules.php GET if= interpolates into value="" and iface = "" when requirefirewallinterface i...

pfsense-ntp-gps-fudge

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ntp-gps-fudge pfsense-ntp-gps-fudge Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.inc concatenates GPS/PPS fudge/refid/stratum into ntpd.conf. mwexec is ntpd -...

pfsense-sshguard-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-sshguard-crlf pfsense-sshguard-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org sshguardthreshold / blocktime / detectiontime are not isnumericint. systemsshguardstart writes...

pfsense-dyndns-cache-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-dyndns-cache-path pfsense-dyndns-cache-path Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Custom host skips isdomain. updatedns builds the cache path as /conf/dyndnsiftype...

opnsense-wlan-wpa-line

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-wlan-wpa-line Write-up: https://abraxaslabs.tech/research/opnsense-wlan-wpa-line opnsense-wlan-wpa-line Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...

pfsense-bsnmpd-conf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-bsnmpd-conf pfsense-bsnmpd-conf Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicessnmpdconfigure interpolates location := "$snmpdcfg'syslocation'". GUI still only...

pfsense-ovpn-learn-cn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-learn-cn pfsense-ovpn-learn-cn Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.learn-address.sh interpolates CN into su -m unbound -c "... localdata $CN.$DOMAIN ..."...

pfsense-pppoe-cron

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-pppoe-cron pfsense-pppoe-cron Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org handlepppoereset uses hidden ptpid without isnumericint. Custom hour/minute validation is AND where it...