abraxas/opnsense-lockout-factory-ipOPNsense 26.7.6 - High - Remote - Privilege leftover - factory lockout IP
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · opnsense-lockout-factory-ip
Class: Privilege leftover Reach: Remote
OPNsense core 26.7.6 (a842fe48) - opnsense.org
Unauth WebGUI login still drives lockout_handler from a factory LOG_AUTH line that has no socket IP. GHSA-2v2x closed CRLF split and switched lockout IP pick to the last token so authgui.inc's trailing from REMOTE_ADDR wins. AuthenticationFactory::authenticate() still syslog()s the raw username with no address suffix. A username that matches a lockout False phrase plus an IPv4 token is the last (only) address on that line. After default 5 spaced attempts: pfctl -t sshlockout -T add and pfctl -k. Default: lockout on, LAN GUI.
| ID | no CVE yet |
| Class | Privilege leftover |
| Reach | Remote (unauthenticated WebGUI login POST) |
| CWE | CWE-117 / CWE-863 |
| CVSS | High: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Product | OPNsense core (Deciso B.V.) |
| Affected | OPNsense core 26.7.6 (a842fe48c21288d11a422cb944678e8eb308becf) AuthenticationFactory / lockout_handler |
| Auth | Unauth. CSRF cookie + token from GET /. |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned tag 26.7.6. The lab is the pinned lockout_handler plus PATH stub pfctl, loopback identity 127.0.0.1:18800. This is not CRLF. One PHP syslog record stays one handler line. Last-IP was the right hardening for the authgui template and the wrong hardening for the factory template.
| Method | Sink | Privilege |
|---|---|---|
Unauth factory LOG_AUTH username with a lockout False phrase plus an IPv4 token (6 spaced lines) | pin lockout_handler -> stub pfctl -t sshlockout -T add and pfctl -k | Integrity (lab-proven): table sshlockout plus state-kill argv. Lab: planted=203.0.113.77. |
| same plant, live pf | filter.lib.inc:293-314 from <sshlockout> to (self) ports 22/GUI | Availability (inferred): drop new TCP 22/GUI from the planted host; pfctl -k tears down existing states from that IP. |
| same username with only the IPv4 (no False phrase) | lockout_handler | Negative (lab-proven): no table add. negative-ip-only=no. |
authgui line with trailing from REMOTE_ADDR | last-IP parser | Integrity of own IP (lab-proven): authgui last token stays 198.51.100.10. |
| Failed-login body | none | Recon (lab-proven closed): existing "Wrong username or password." No user enum. |
Lab-proven vs inferred: factory plant, username-only negative, and authgui last-IP are lab SUCCESS. Live pf blocking and live session kill are inferred. Pin lockout_handler copied unchanged; syslog-ng and WebGUI POST are stubbed.
Requires: Unauth WebGUI login POST. CSRF cookie + token from GET /. Lockout on (system.no_sshlockout unset). Default install.
| Surface | Lab |
|---|---|
Unauth session / root / config.xml write | closed |
| authgui line planting a foreign IP | last token is REMOTE_ADDR (authgui-last-ip=198.51.100.10) |
CRLF extra readline() | GHSA-2v2x rewrite; one record stays one line |
| Empty-password login | authgui.inc requires non-empty password |
| CVE-2026-44195 success-keyword reset on the authgui line | failure rules first |
26.7.6 Omar Habra pfctl -k str(ip) TypeError | already on this pin |
| Planted IP as DNS/gateway destination | rules are from <sshlockout> to (self) ports 22/GUI only |
No login skip. No RCE. No rewrite of config.xml. Does not mint a session.
cd lab
./run.sh
Loopback 127.0.0.1:18800. Compose project opnsense-lockout-factory-ip. Image tag opnsense-lockout-factory-ip:26.7.6. Witness OPNSENSE-LOCKOUT-FACTORY-IP-WITNESS. Last line:
SUCCESS opnsense-lockout-factory-ip planted=203.0.113.77 table=sshlockout negative-ip-only=no authgui-last-ip=198.51.100.10 OPNSENSE-LOCKOUT-FACTORY-IP-WITNESS
Append the socket IP to the factory syslog(LOG_AUTH) template, same trailing from REMOTE_ADDR as authgui.inc. Or ignore lockout IPs that did not come from the handler's own peer. Do not treat last-token as a substitute for "the client address."
a842fe48c21288d11a422cb944678e8eb308becfAuthenticationFactory.phplockout_handler