abraxas/opnsense-ntp-gps-fudgeOPNsense 26.7.6 - High - Remote - Config line injection - NTP GPS fudge
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · opnsense-ntp-gps-fudge
Class: Config line injection Reach: Remote
OPNsense core 26.7.6 (a842fe48) - opnsense.org
Leftover of GHSA-fq94. GPS/PPS fudge1 / fudge2 / refid still concatenate into /var/etc/ntpd.conf after timeserver hosts were stripped. CVE-2026-53581 path overwrite is allowlisted (^cua[a-z0-9.,{}]+$ plus a char device). The general NTP page already treats extra ntpd.conf text as escalation (userIsAdmin). GPS/PPS ACLs are separate. Save configd_run('service restart ntpd'). ntpd runs as root with no -u.
| ID | no CVE yet |
| Class | Config line injection |
| Reach | Remote (authenticated WebGUI) |
| CWE | CWE-93 / CWE-74 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | OPNsense core (Deciso B.V.) |
| Affected | OPNsense core 26.7.6 (a842fe48c21288d11a422cb944678e8eb308becf) NTP GPS/PPS fudge |
| Auth | WebGUI session with page-services-ntp-gps and/or page-services-ntp-pps |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned tag 26.7.6. The lab is a PHP gadget of pinned ntpd_configure_do, loopback identity 127.0.0.1:18830. GPS fudge CR/LF wrote an extra logfile line. Timeserver host CR/LF collapsed to one token.
| Method | Sink | Privilege |
|---|---|---|
GPS fudge1 CR/LF | pin ntpd_configure_do extra logfile /oracle/OPNSENSE-NTP-GPS-FUDGE-WITNESS after fudge 127.127.20.0 | Integrity (lab-proven): ntpd.conf extra line. Lab: fudge-newline=yes. |
honor of includefile / driftfile / statsdir | ntpd as root, no -u | Integrity (inferred): extra ntpd policy / file write at an ntpd-writable path. ntpd not started in the gadget. |
| timeserver host CR/LF | ntpd.inc:327-329 strip | Negative (lab-proven): timeserver collapsed to one token. timeserver-stripped=yes. |
PPS fudge1 / refid CR/LF | PPS fudge 127.127.22.0 block | Integrity (inferred): same class. Gadget ran the GPS path. |
| invalid extra directive | ntpd start | Availability (inferred): ntpd can fail to start. |
| this path | none | Recon: no extra read of config.xml secrets. |
Lab-proven vs inferred: GPS fudge newline and timeserver strip are lab SUCCESS. PPS sibling and live ntpd as root are inferred.
Requires: page-services-ntp-gps (lab) and/or page-services-ntp-pps. Not page-all. Live /dev/cua* char node so configure_gps/pps returns true. NTP enabled. CSRF token. Browser <input type="text"> will not keep CR/LF; a direct POST from that session will.
| Surface | Lab |
|---|---|
| CVE-2026-53581 arbitrary-path overwrite | ../ no longer leaves /dev/ (gps-char=char) |
| GHSA-h793 GPS XSS | no chain to this leftover |
| Timeserver host CR/LF | stripped (timeserver-stripped=yes) |
custom_options on the general NTP page | page-all / userIsAdmin only |
| Unauth | closed |
No unauth. No 53581 path overwrite. Timeserver hosts already got the strip.
cd lab
./run.sh
Loopback 127.0.0.1:18830. Compose project opnsense-ntp-gps-fudge. Witness OPNSENSE-NTP-GPS-FUDGE-WITNESS. Last line:
SUCCESS opnsense-ntp-gps-fudge fudge-newline=yes timeserver-stripped=yes OPNSENSE-NTP-GPS-FUDGE-WITNESS
Strip CR/LF (and treat quotes) on GPS/PPS fudge1 / fudge2 / refid the same way timeserver hosts already do at ntpd.inc:327-329. Or constrain those fields to a numeric / token class. Keep extra ntpd.conf text behind userIsAdmin.
a842fe48c21288d11a422cb944678e8eb308becfntpd.inc ntpd_configure_doservices_ntpd_gps.php