PT-2019-14777 · Netgate · Pfsense

Published 2019-09-25 · Updated 2019-09-25 · CVE-2019-16701

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pfSense versions 2.3.4 through 2.4.4-p3

Description The issue allows for remote code injection via a methodCall XML document. This is achieved by using a pfsense.exec php call that contains shell metacharacters in a parameter value, such as parameter value. This enables an attacker to inject malicious code.

Recommendations For pfSense versions 2.3.4 through 2.4.4-p3, consider disabling the pfsense.exec php function to prevent remote code injection until a patch is available. Restrict access to the XML document methodCall to minimize the risk of exploitation. Avoid using parameter values that contain shell metacharacters in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-16701

Affected Products

Pfsense

References · 6

• 🔥 http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html · Exploit
• 🔥 https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more · Exploit
• 🔥 https://exploit-db.com/exploits/47413 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16701 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16701 · Vendor Advisory
• https://github.com/pfsense/pfsense/commits/master · Note