Netgate pfSense 2.7.0 XML File config.xml restore_rrddata command injection

Summaryinfo

A vulnerability labeled as critical has been found in Netgate pfSense 2.7.0. This affects the function restore_rrddata of the file config.xml of the component XML File Handler. Such manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2023-27253. Moreover, an exploit is present. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Netgate pfSense 2.7.0 (Firewall Software). It has been rated as critical. Affected by this issue is the function restore_rrddata of the file config.xml of the component XML File Handler. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.

The weakness was disclosed 03/18/2023 as 13935. The advisory is shared for download at redmine.pfsense.org. This vulnerability is handled as CVE-2023-27253 since 02/27/2023. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1202.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:config.xml it is possible to find vulnerable targets with Google Hacking.

Applying the patch ca80d18493f8f91b21933ebd6b714215ae1e5e94 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51608). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Netgate

Name

• pfSense

Version

• 2.7.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion