PT-2019-14777 · Netgate · Pfsense

Publicado 2019-09-25 · Atualizado 2019-09-25 · CVE-2019-16701

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pfSense versions 2.3.4 through 2.4.4-p3

Description The issue allows for remote code injection via a methodCall XML document. This is achieved by using a pfsense.exec php call that contains shell metacharacters in a parameter value, such as parameter value. This enables an attacker to inject malicious code.

Recommendations For pfSense versions 2.3.4 through 2.4.4-p3, consider disabling the pfsense.exec php function to prevent remote code injection until a patch is available. Restrict access to the XML document methodCall to minimize the risk of exploitation. Avoid using parameter values that contain shell metacharacters in the affected API endpoint until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-16701

Produtos afetados

Pfsense

Referências · 6

• 🔥 http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html · Exploit
• 🔥 https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more · Exploit
• 🔥 https://exploit-db.com/exploits/47413 · Exploit
• https://github.com/pfsense/pfsense/commits/master · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16701 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16701 · Aviso do Fabricante