abraxas/pfsense-https-host-redirectpfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - Open redirect - HTTP 301 $http_host
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-https-host-redirect
Class: Open redirect Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
system.inc emits a port-80 server{} with return 301 https://$http_host$redirectport$request_uri; and no server_name. nginx returns 301 before php-fpm, so auth.inc DNS-rebind never runs.
| ID | no CVE yet |
| Class | Open redirect |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-601 |
| CVSS | Medium: 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with unauth client that can hit the WebGUI HTTP listener |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19210.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| unauth GET / on TCP/80 with a hostile Host | nginx return 301 https://$http_host... | Integrity: None. |
| same leftover | same sink | Recon: Lab-proven: Host evil.example became Location https://evil.example/index.php. PHP DNS-rebind 501 does not run on this 301. |
| same leftover | same sink | Availability: None shown. |
Requires: unauth client that can hit the WebGUI HTTP listener. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: unauth client that can hit the WebGUI HTTP listener. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
PHP DNS-rebind on the HTTPS GUI itself.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19210. Compose project pfsense-https-host-redirect. Witness PFSENSE-HTTPS-HOST-REDIRECT-WITNESS. Loopback only: 127.0.0.1:19210. Compose project pfsense-https-host-redirect. Witness PFSENSE-HTTPS-HOST-REDIRECT-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-HTTPS-HOST-REDIRECT control-localhost=yes trigger-evil=yes php-rebind-skips-301=yes PFSENSE-HTTPS-HOST-REDIRECT-WITNESS
Use a configured hostname, or $host (allowlisted), not $http_host.
9363ac5b8651a1c7a333180425ce7719070f95f9