abraxas/pfsense-ovpn-learn-cnpfSense CE 2.9.0-DEVELOPMENT - High - Remote - RCE - OpenVPN learn-address CN
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-ovpn-learn-cn
Class: RCE Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT (9363ac5) - pfsense.org
openvpn.learn-address.sh interpolates CN into su -m unbound -c "... local_data ${CN}.${DOMAIN} ..." unquoted. Gated on unbound/regovpnclients. A CN without a shell char still plants local-data.
| ID | no CVE yet |
| Class | RCE |
| Reach | Remote (authenticated WebGUI unless noted) |
| CWE | CWE-78 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Product | pfSense CE |
| Affected | 2.9.0-DEVELOPMENT (9363ac5b8651a1c7a333180425ce7719070f95f9) |
| Auth | WebGUI session with OpenVPN cert client CN when Unbound Register OpenVPN clients is on |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned public master 9363ac5. The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19080.
Series write-up: https://abraxaslabs.tech/research/pfsense-ce-leftovers
| Method | Sink | Privilege |
|---|---|---|
| OpenVPN learn-address with a hostile CN | openvpn.learn-address.sh su -m unbound -c ... ${CN} | Integrity: Lab-proven: CN $(w) ran extra w as the su -c string. CONTROL also planted unsanitized local-data. |
| same leftover | same sink | Recon: Inferred: commands as unbound. |
| same leftover | same sink | Availability: Inferred: poison resolver local-data. |
Requires: OpenVPN cert client CN when Unbound Register OpenVPN clients is on. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: OpenVPN cert client CN when Unbound Register OpenVPN clients is on. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Off unless Register OpenVPN clients is enabled. Local CN charset may still allow some chars.
No Diagnostics: Command unless that page is also granted.
cd lab
./run.sh
Loopback 127.0.0.1:19080. Compose project pfsense-ovpn-learn-cn. Witness PFSENSE-OVPN-LEARN-CN-WITNESS. Loopback only: 127.0.0.1:19080. Compose project pfsense-ovpn-learn-cn. Witness PFSENSE-OVPN-LEARN-CN-WITNESS. PHP gadget of the pinned lines. Stack tears down after the run.
Last line:
SUCCESS PFSENSE-OVPN-LEARN-CN control-local-data=yes control-no-witness=yes m24-local-data-plant=yes trigger-exec=yes PFSENSE-OVPN-LEARN-CN-WITNESS
Quote CN. Reject shell metacharacters. Keep local-data through unbound-control without a shell.
9363ac5b8651a1c7a333180425ce7719070f95f9