abraxas/pfsense-bsnmpd-confpfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - Config injection - bsnmpd syslocation
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-bsnmpd-conf
Class: Config injection Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
services_snmpd_configure interpolates location := "{$snmpdcfg['syslocation']}". GUI still only rejects #. Extra read := community line. No include/exec without a planted .so.
| ID | no CVE yet |
| Class | Config injection |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-74 |
| CVSS | Medium: 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with page-services-snmp |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19220.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| POST services_snmp.php syslocation | location := "{$snmpdcfg['syslocation']}" | Integrity: Lab-proven: extra community line in snmpd.conf. mwexec stayed bsnmpd -c . |
| same leftover | same sink | Recon: Inferred: extra community can widen SNMP read if bsnmpd honors the second read. |
| same leftover | same sink | Availability: Inferred: parse-fail snmpd. |
Requires: page-services-snmp. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: page-services-snmp. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
No include/exec without a planted .so. Not shell.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19220. Compose project pfsense-bsnmpd-conf. Witness PFSENSE-BSNMPD-CONF-WITNESS. Loopback only: 127.0.0.1:19220. Compose project pfsense-bsnmpd-conf. Witness PFSENSE-BSNMPD-CONF-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-BSNMPD-CONF control-one-syslocation=yes trigger-extra-community=yes PFSENSE-BSNMPD-CONF-WITNESS
Reject quote/semicolon/newline in location/contact/community/trap.
9363ac5b8651a1c7a333180425ce7719070f95f9