PT-2022-20948 · Unknown · Pfsense Pfblockerng

Byr00T · Published 2022-09-05 · Updated 2024-11-04 · CVE-2022-31814

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense pfBlockerNG versions 2.1.4 26 and earlier

Description The issue allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. It is estimated that over 388,000 devices may be affected. A proof-of-concept exploit is available, and there have been reports of this issue being exploited in the wild. The vulnerability can be exploited through the HTTP Host header, allowing attackers to execute arbitrary OS commands.

Recommendations For pfSense pfBlockerNG versions 2.1.4 26 and earlier, consider disabling the vulnerable component until a patch is available. Restrict access to the HTTP Host header to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-31814

Affected Products

Pfsense Pfblockerng

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pfsense_pfblockerng_webshell.rb · Exploit
• 🔥 https://github.com/Laburity/CVE-2022-31814 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-31814 · Exploit
• 🔥 https://github.com/EvergreenCartoons/SenselessViolence · Exploit
• 🔥 http://packetstormsecurity.com/files/168743/pfSense-pfBlockerNG-2.1.4_26-Shell-Upload.html · Exploit
• 🔥 https://ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/51032 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31814 · Vendor Advisory
• https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31814 · Security Note
• https://github.com/pfsense/FreeBSD-ports/pull/1169/commits/071bdcf2d918c3e51cde11cf81fbd9b6f0379d7e · Note
• https://github.com/pfsense/FreeBSD-ports/pull/1169 · Note
• https://twitter.com/rst_cloud/status/1837592488875286537 · Twitter Post
• https://t.me/rnetsec/17343 · Telegram Post
• https://t.me/rnetsec/20662 · Telegram Post