PT-2023-8202 · Opnsense · Opnsense

Feliks Penconek · Published 2023-06-28 · Updated 2024-02-22 · CVE-2023-38997

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2

Description A directory traversal vulnerability exists in the Captive Portal templates of OPNsense, allowing attackers to execute arbitrary system commands as root via a crafted ZIP archive. This issue arises due to incorrect restriction of the directory path name with limited access. Exploitation of this vulnerability may enable a remote attacker to execute arbitrary commands with root privileges using a specially crafted ZIP archive.

Recommendations For OPNsense Community Edition versions prior to 23.7, update to version 23.7 or later to resolve the issue. For OPNsense Business Edition versions prior to 23.4.2, update to version 23.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Captive Portal templates until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-00194

CVE-2023-38997

Affected Products

Opnsense

References · 7

• 🔥 https://logicaltrust.net/blog/2023/08/opnsense.html · Exploit
• https://github.com/opnsense/core/commit/448762d440b51574f1906c0ec2f5ea6dc4f16eb2 · Patch
• https://osv.dev/vulnerability/CVE-2023-38997 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00194 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38997 · Security Note
• https://t.me/cvenotify/56141 · Telegram Post
• https://t.me/cvenotify/72228 · Telegram Post