abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  pfsense-carp-vhid

pfsense-carp-vhid

Class: RCE Reach: Remote

pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org

Virtual IP edit stores CARP VHID from POST with no 1-255 check. Form_Select options are HTML only. CARP apply escapeshellargs the VHID. Stacked IP Alias apply interpolates vhid {$carpvip['vhid']} outside escapeshellarg. CARP status interpolates the same stored VHID into a double-quoted grep pipeline; semicolon stays quoted, command substitution still runs under /bin/sh -c. Privilege is VIP edit + apply, not Diagnostics: Command.

ID	no CVE yet
Class	RCE
Reach	Remote (authenticated WebGUI)
CWE	CWE-78
CVSS	High: 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Product	pfSense CE
Affected	2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) CARP VHID
Auth	WebGUI session with VIP edit + apply (status/widget is a later trigger)
License	GNU Affero GPL v3.0
Lab	127.0.0.1 only

I pinned public master 9363ac5. The lab is a PHP gadget of pinned interface_carp_configure, stacked ipalias mwexec, and status exec. Loopback 127.0.0.1:18830.

What an attacker can do

Method	Sink	Privilege
POST carp VIP with a non-integer VHID, then apply a stacked IP Alias on that _vip{uniqid} parent	mwexec ifconfig ... alias {$gateway} {$vhid} (interfaces.inc:3238)	Integrity (lab-proven): root shell. Lab: ipalias-unescaped wrote the witness. CARP apply of the same VHID wrote none (carp-escaped=yes).
Same stored VHID, then GET status_carp.php or render carp_status.widget.php	exec grep pipeline (pfsense-utils.inc:794)	Integrity (lab-proven): command substitution inside the double quotes ran and wrote the witness (status-sink=yes, status-subst=yes). Semicolon stayed quoted. Widget trigger can be another GUI session.
Same root shell	host filesystem	Recon (inferred): config.xml, keys.
Root shell or broken ifconfig	CARP / alias devices	Availability (inferred): interface / CARP / filter disruption.

Lab-proven vs inferred: carp-escaped, ipalias-unescaped witness, and status command-substitution witness are lab-proven. Filesystem recon and filter disruption are inferred from root PHP-FPM.

Requires: page-firewall-virtualipaddress-edit (save) and page-firewall-virtualipaddresses (apply). Status sink: page-status-carp or any dashboard with the CARP widget. CSRF on POST.

Adjacent surface that stays closed

Surface	Lab
CARP apply itself	escapeshellarg on VHID, carp-escaped=yes
CARP password / advbase / advskew / subnet	is_ipaddr / escaped
Unauth	closed
xmlrpc apply of the same objects without HA creds	SA-26_22 skip-list
Diagnostics: Command	stays closed unless also granted

Lab

cd lab
./run.sh

Loopback 127.0.0.1:18830. Compose project pfsense-carp-vhid. Image tag pfsense-carp-vhid:2.9.0-dev. Witness PFSENSE-CARP-VHID-WITNESS. Last line:

SUCCESS PFSENSE-CARP-VHID carp-escaped=yes ipalias-unescaped=yes status-sink=yes PFSENSE-CARP-VHID-WITNESS

The fix

Integer-range the VHID to 1-255 on save. escapeshellarg the VHID on stacked IP Alias apply and on the status grep, the same way CARP apply already does.

References

• github.com/pfsense/pfsense 9363ac5b8651a1c7a333180425ce7719070f95f9
• firewall_virtual_ip.inc saveVIP
• interfaces.inc stacked ipalias mwexec
• pfsense-utils.inc CARP status grep
• CWE-78