HTTP: Netgate pfSense Command Injection

This signature detects attempts to exploit a known vulnerability against Netgate pfSense. A successful attack can lead to command injection and arbitrary code execution.

Extended Description

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.

Affected Products

Pfsense pfsense

References

CVE: CVE-2023-27253

URL: https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html https://github.com/pfsense/pfsense/commit/db0cdbc8e77a47b45a6da4061e5d8e59e0fc592d https://github.com/pfsense/pfsense/commit/ca80d18493f8f91b21933ebd6b714215ae1e5e94

Short Name

HTTP:CTS:NETGATE-PFSENSE-CI

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Netgate pfSense Command Injection

Extended Description

Affected Products

References

Found a potential security threat?