PT-2022-11381 · Pfsense · Pfsense

Abdel Adim + 1 · Published 2022-03-01 · Updated 2022-07-12 · CVE-2021-41282

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pfSense version 2.5.2

Description The issue allows sed data injection in diag routes.php. Authenticated users can inject sed-specific code and write an arbitrary file in an arbitrary location. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although common protection mechanisms against command injection are used, such as the escapeshellarg function for the arguments, the sed-specific code injection is still possible.

Recommendations For pfSense version 2.5.2, consider disabling the diag routes.php functionality until a patch is available to prevent sed data injection. Restrict access to the netstat utility and sed utility to minimize the risk of exploitation. Avoid using the sed utility to parse the output of the netstat utility in the affected diag routes.php file until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-41282

Affected Products

Pfsense

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pfsense_diag_routes_webshell.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html · Exploit
• 🔥 https://shielder.it/advisories/pfsense-remote-command-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41282 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41282 · Vendor Advisory
• https://t.me/cvenotify/27970 · Telegram Post
• https://shielder.it/advisories · Note
• https://t.me/cvenotify/27587 · Telegram Post
• https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html · Note