abraxas/pfsense-ovpn-connect-evalpfSense CE 2.9.0-DEVELOPMENT - High - Remote - RCE - OpenVPN connect eval
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-ovpn-connect-eval
Class: RCE Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
openvpn.connect_async.sh eval "/sbin/pfctl -a '${anchorname}' ..." with anchorname=openvpn/${dev}${username}${trusted_port}. Single quotes do not contain the username after expand. Local GUI preg rejects shell chars; RADIUS usernames skip that check.
| ID | no CVE yet |
| Class | RCE |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-78 |
| CVSS | High: 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with OpenVPN server_user / server_tls_user client (RADIUS/LDAP username) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19070.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| OpenVPN client-connect with RADIUS username | openvpn.connect_async.sh eval pfctl -a '${anchorname}' | Integrity: Lab-proven: username alice'; w; : ' ran extra w. Local GUI charset rejects that username. |
| same leftover | same sink | Recon: Lab-proven: pfctl argv for that session. Inferred: disconnect rm /tmp/${username}. |
| same leftover | same sink | Availability: Inferred: pfctl -F rules on the user anchor. |
Requires: OpenVPN server_user / server_tls_user client (RADIUS/LDAP username). CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: OpenVPN server_user / server_tls_user client (RADIUS/LDAP username). CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Local Database username charset. Unauth N/A in the gadget.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19070. Compose project pfsense-ovpn-connect-eval. Witness PFSENSE-OVPN-CONNECT-EVAL-WITNESS. Loopback only: 127.0.0.1:19070. Compose project pfsense-ovpn-connect-eval. Witness PFSENSE-OVPN-CONNECT-EVAL-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-OVPN-CONNECT-EVAL control-eval=yes local-gui-charset-rejects-trigger=yes trigger-eval=yes PFSENSE-OVPN-CONNECT-EVAL-WITNESS
Stop eval. Pass the anchor as a literal argv to pfctl. Filter RADIUS usernames the same as local.
9363ac5b8651a1c7a333180425ce7719070f95f9