opnsense-wlan-wpa-line

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-wlan-wpa-line Write-up: https://abraxaslabs.tech/research/opnsense-wlan-wpa-line opnsense-wlan-wpa-line Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...

pfsense-ntp-gps-fudge

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ntp-gps-fudge pfsense-ntp-gps-fudge Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.inc concatenates GPS/PPS fudge/refid/stratum into ntpd.conf. mwexec is ntpd -...

pfsense-rules-if-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rules-if-xss pfsense-rules-if-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org firewallrules.php GET if= interpolates into value="" and iface = "" when requirefirewallinterface i...

pfsense-dhcpd-conf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-dhcpd-conf pfsense-dhcpd-conf Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicesdhcpdv4configure interpolates filename "$sm'filename'"; with no addslashes. GUI...

pfsense-dyndns-cache-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-dyndns-cache-path pfsense-dyndns-cache-path Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Custom host skips isdomain. updatedns builds the cache path as /conf/dyndnsiftype...

pfsense-bsnmpd-conf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-bsnmpd-conf pfsense-bsnmpd-conf Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicessnmpdconfigure interpolates location := "$snmpdcfg'syslocation'". GUI still only...

pfsense-pppoe-cron

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-pppoe-cron pfsense-pppoe-cron Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org handlepppoereset uses hidden ptpid without isnumericint. Custom hour/minute validation is AND where it...

pfsense-carp-vhid

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-carp-vhid Write-up: https://abraxaslabs.tech/research/pfsense-carp-vhid pfsense-carp-vhid Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Virtual IP edit stores CARP VHID from POST...

pfsense-timezone-phpini

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-timezone-phpini pfsense-timezone-phpini Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.php writes $POST'timezone' with no inarray against systemgettimezonelist. istimezone...

pfsense-rss-file-redirect

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rss-file-redirect pfsense-rss-file-redirect Class: File read Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org isURL is not HTTP-only. SimplePie fixprotocol rewrites direct file:// to http...

pfsense-gw-ipv6-zone

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-gw-ipv6-zone pfsense-gw-ipv6-zone Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org isipaddrv6 strips %zone for NetIPv6::checkIPv6 and never charset-checks the zone. startdpinger...

pfsense-auth-username-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-auth-username-xss pfsense-auth-username-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org head.inc logout title interpolates $SESSION'Username' raw. passwordmg FormStaticText is...

pfsense-config-readonly-restore

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-config-readonly-restore pfsense-config-readonly-restore Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org writeconfig honors user-config-readonly. configinstall and...

pfsense-limiter-aqm

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-limiter-aqm pfsense-limiter-aqm Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org FormatParameters / vsprintf of AQM params into /tmp/rules.limiter, then mwexec"/sbin/dnc...

pfsense-uploadconfig

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-uploadconfig pfsense-uploadconfig Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org uploadconfig.php POST config= calls configinstall then systemreboot. IDENT has no...

pfsense-ldap-name-collision

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ldap-name-collision pfsense-ldap-name-collision Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org getUserEntry$name returns the local row on name match. isAdminUID then...

pfsense-ovpn-connect-eval

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-connect-eval pfsense-ovpn-connect-eval Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.connectasync.sh eval "/sbin/pfctl -a '$anchorname' ..." with...

pfsense-voucher-expire-sqli

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-voucher-expire-sqli pfsense-voucher-expire-sqli Class: SQLi Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org voucher.inc captiveportalreaddb"WHERE username = '$voucher'" then first-row sessioni...

pfsense-unbound-acl-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-unbound-acl-crlf pfsense-unbound-acl-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org ACL name/action go into accesslists.conf with no checkconf. Same include: class as...

pfsense-logs-filter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-logs-filter-xss pfsense-logs-filter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org statuslogsfilter.php POST resolve= jsonencode with no JSONHEXTAG and default Content-Type...