abraxas/pfsense-limiter-aqmpfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - Config injection - limiter AQM newline
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-limiter-aqm
Class: Config injection Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
FormatParameters / vsprintf of AQM params into /tmp/rules.limiter, then mwexec("/sbin/dnctl {$g['tmp_path']}/rules.limiter"). Apply argv is the file path. Hidden-number delete is a different leftover already reported.
| ID | no CVE yet |
| Class | Config injection |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-74 |
| CVSS | Medium: 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with page-firewall-trafficshaper-limiter |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19260.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| POST firewall_shaper_vinterface.php AQM target/interval | vsprintf into /tmp/rules.limiter then dnctl of that path | Integrity: Lab-proven: extra pipe line in rules.limiter. Apply argv stayed dnctl of that path. Not shell. |
| same leftover | same sink | Recon: Lab-proven: witness is not in argv. |
| same leftover | same sink | Availability: Inferred: hostile dummynet pipes after apply. |
Requires: page-firewall-trafficshaper-limiter. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: page-firewall-trafficshaper-limiter. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Not shell. Limiter names stay charset-limited. Create overwrite and delete concat already mailed.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19260. Compose project pfsense-limiter-aqm. Witness PFSENSE-LIMITER-AQM-WITNESS. Loopback only: 127.0.0.1:19260. Compose project pfsense-limiter-aqm. Witness PFSENSE-LIMITER-AQM-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-LIMITER-AQM control-one-pipe-line=yes trigger-extra-dnctl=yes apply-file-argv=yes PFSENSE-LIMITER-AQM-WITNESS
Numeric-check AQM params. Reject CR/LF.
9363ac5b8651a1c7a333180425ce7719070f95f9