PT-2018-5244 · Netgate · Pfsense

Yorick Koster · Published 2018-01-03 · Updated 2019-05-30 · CVE-2017-1000479

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense versions 2.4.1 and lower

Description The issue allows for clickjacking attacks in the CSRF error page, resulting in privileged execution of arbitrary code. This occurs because error detection happens before an X-Frame-Options header is set.

Recommendations For pfSense versions 2.4.1 and lower, update to version 2.4.2-RELEASE or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-1000479

Affected Products

Pfsense

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pfsense_clickjacking.rb · Exploit
• 🔥 http://openwall.com/lists/oss-security/2017/11/22/7 · Exploit
• 🔥 https://securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html · Exploit
• https://github.com/pfsense/pfsense/commit/386d89b07 · Patch
• https://github.com/opnsense/core/commit/d218b225 · Patch
• https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000479 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000479 · Vendor Advisory
• https://netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-available.html · Note