Three severe vulnerabilities have been discovered in the pfSense firewall software, putting systems at risk of malicious code injection, manipulation of cloud backup data, and potential remote code execution. These issues impact pfSense Community Edition (CE) versions prior to 2.8.0 beta, along with corresponding pfSense Plus builds.
The identified vulnerabilities—CVE-2024-57273, CVE-2024-54780, and CVE-2024-54779—exploit security gaps in the Automatic Configuration Backup (ACB) service, OpenVPN widget, and dashboard widgets.
Compromising Cloud Backups through SSH Key Derivation (CVE-2024-57273)
The first of these flaws, CVE-2024-57273, targets the Automatic Configuration Backup (ACB) service, enabling attackers to potentially take control of cloud backup keys. This vulnerability can lead to the loss of backups, stored cross-site scripting (XSS) attacks, and leakage of sensitive data.
To exploit CVE-2024-57273, two conditions must be met: the firewall must have an accessible SSH server, and the ACB service must be configured. The issue arises from how the API key for cloud backups is derived from the public SSH key found in /etc/ssh/ssh_host_ed25519_key.pub. As highlighted in a researcher’s blog, “It’s simple for an attacker to derive the key and either delete or poison your cloud backups.”
An alarming example of this flaw is the ability for attackers to inject malicious JavaScript code into the “reason” field within the backup files.
When an administrator accesses the backup list, the injected malicious code is triggered within their browser, posing a significant security threat.
OpenVPN Command Injection (CVE-2024-54780)
The second vulnerability, CVE-2024-54780, is a command injection flaw within the OpenVPN widget. This authenticated vulnerability enables attackers to execute arbitrary OpenVPN management commands through the unsanitized remipp parameter.
The root cause of this vulnerability lies in the improper handling of user input, where data is passed directly to the OpenVPN management interface without adequate sanitization, allowing malicious commands to be injected and executed.
An attacker can exploit this flaw by injecting a newline character, followed by a malicious command (e.g., remipp=5%0Astatus), causing both commands to execute.
XML Injection via Dashboard Widgets (CVE-2024-54779)
The third vulnerability, CVE-2024-54779, enables XML injection within the dashboard widgets via the widgetkey parameter. This security flaw can lead to the corruption of configuration files and facilitate persistent cross-site scripting (XSS) attacks.
The issue arises from the flawed handling of the widgetkey parameter, which is directly incorporated into XML structures without any sanitization, allowing for malicious modifications to the configuration.
In the most severe cases, this vulnerability can disrupt the firewall’s ability to initialize correctly, potentially leading to a complete denial of service.
| CVE Identifier | Affected Products | Impact | Exploit Prerequisites | CVSS 3.1 Score |
|---|---|---|---|---|
| CVE-2024-57273 | pfSense CE (versions before 2.8.0 beta) and pfSense Plus builds | Stored XSS in ACB service, backup deletion, and information leakage | Accessible SSH server and ACB service enabled | 5.4 (Medium) |
| CVE-2024-54780 | pfSense CE (versions before 2.8.0 beta) and pfSense Plus builds | Arbitrary command execution via OpenVPN management interface | Authenticated access to the dashboard with OpenVPN widget privileges | 8.8 (High) |
| CVE-2024-54779 | pfSense CE (versions before 2.8.0 beta) and pfSense Plus builds | XML injection leading to configuration corruption and persistent XSS | Authenticated access to dashboard widget configuration | 5.4 (Medium) |
Mitigation Measures
Netgate, the developer of pfSense, has addressed these vulnerabilities in the upcoming pfSense Plus 25.03 and pfSense CE 2.8.0 releases.
Additionally, fixes have been made available for existing pfSense Plus 24.11 and pfSense CE 2.7.2 versions through the System Patches Package.
The released patches resolve several critical issues, including:
- Multiple XSS vulnerabilities within Dashboard widgets
- Command injection in the OpenVPN management interface
- XSS attacks within the AutoConfigBackup backup list
- Possible exposure of the AutoConfigBackup Device Key
- Stored XSS vulnerabilities across various system components
These vulnerabilities were reported to Netgate by security researchers between November and December 2024, with patches now accessible in the pfSense 2.8.0 beta and the GitHub master branch.
The Exploit Prediction Scoring System (EPSS) indicates a very low probability of exploitation for CVE-2024-54779, estimating a 0.03% chance, placing it in the 7th percentile of vulnerabilities. However, administrators are strongly urged to apply the available patches promptly.
To mitigate these vulnerabilities, users should upgrade to pfSense CE version 2.8.0 or higher, or the corresponding pfSense Plus version. For those who are unable to update immediately, installing the System Patches Package and applying the recommended fixes will offer temporary protection.
