8 ms·

Multiple Vulnerabilities in PfSense

122 points by pelasaco 5y ago

tedunangst 5y ago
The "specially crafted request" is just dumb when you realize it means "a string with a semicolon" or such. Was sadly hoping this phrase had died.
- q1w2 5y ago
  This is just standard netsec jargon.
  - hansel_der 5y ago
    a semicolon can be considered a 'special' character alright ...
0x0000000 5y ago
> Can this vulnerability be exploited remotely? > Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
- Arnavion 5y ago
  I would hope nobody's opening up the admin interface to the internet. It's certainly not the default. The pfSense / OPNsense codebase is not written to be secure against malicious users in general, even unauthenticated ones that can't get past the login screen. For example I'm pretty sure php-fpm does nothing to prevent slow-loris. (The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.)
  - vladvasiliu 5y ago
    > (The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.) Also, at least in OPNsense, for some reason, not all interfaces get an IP in the DNS. So if you want to access the admin interface via a name with a certificate, it may not always work if you selectively enable the listening interfaces. I've had this happened a week ago, where the DNS name wouldn't resolve to the internal interface's IP for some reason... I would only get the WAN interface and some other restricted one I have.
    - Arnavion 5y ago
      Change the Unbound settings to only listen on LAN interfaces, or even just one specific LAN interface. Eg I have four LAN interfaces but have Unbound configured to only listen on LAN1, so my router FQDN only resolves to the IPs of LAN1.
  - pelasaco 5y ago
    I think the scenario isn't people hitting it through internet, but some attack chain involving, for instance a clickjacking, XSRF, XSS,etc in another website that try to access the UI in case the admin is authenticated in the firewall, visits the malicious website.
  - suifbwish 5y ago
    I have never been able to figure out the intent of random slow loris attacks I’ve seen and mitigated on small networks I’ve worked on. It’s just random IPs connecting to the webserver for no reason other than to jam it. It’s not even a competition thing it’s like having a super soaker full of superglue and just spraying it up in the air blindfolded.
- dogecoinbase 5y ago
  Not great, but also a bit it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway.
- donmcronald 5y ago
  > This vulnerability can be exploited by a remote authenticated privileged user via the Internet. I don’t get it. If you’re authenticated as a privileged user, don’t you have access anyway?
  - dspillett 5y ago
    When holes like this are exploited it is in combination with other flaws like another app having an XSS flaw which allows a rogue script to make arbitrary connections. If you happen to have an active login session on the admin interface, that script could use the hole to make changes unbeknownst to you. Also in a situation where you have admins with different levels of access, exploits like this could allow an individual low on gruntles to create a privilege escalation situation and gain access to features they should not. So a low probability of exploit due to the mitigating factor, but a high potential for damage if an exploit is attempted and succeeds.
cerved 5y ago
multiple means 2
- dspillett 5y ago
  Multiple means 2 or more, which includes 2. I'd have not used that wording either, but it is technically incorrect.
muppetman 5y ago
Please use Opnsense now, or something else entirely (Vyos is great but CLI based). I was a big pfSense fan, telling myself that the odd stuff Netgate did was normal/justified. Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now. Opnsense is a great replacement. I'm sure it's not perfect, but they're open, friendly, responsive and don't make you question every comment you write on their forum for fear of being banned.
- robbiet480 5y ago
  I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.
  - lostlogin 5y ago
    There is some bad bad shit in that kit. The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great. I’d pay more if the software quality were better.
    - 8fingerlouie 5y ago
      > However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. I've been running a UDM and UDMP for years, and have literally never run into any of those issues, despite having a somewhat complex network (for a home network anyway). It runs 24/7 and only needs reboots when a software update requires it. Multiple VLANs, road warrior VPN. I run a site to site VPN between my UDMP at home and UDM at my summerhouse, and that has been rock solid as well. In the latest EA version of the software, there is also some support for Wireguard (though UI's Teleport). I'm not sure if "raw" Wireguard is available (yet). Latest version also implements policy based routing.
getcrunk 5y ago
2 vulnerabilities and both require access to the webgui.
resonanttoe 5y ago
JPCert has a better notification page (And the actual three, instead of dropping the Captive portal XSS) http://jvn.jp/en/jp/JVN87751554/index.html http://jvn.jp/en/jp/JVN87751554/index.html But these are all pretty lame "vulenrabilities".
dspillett 5y ago
Same information without “by looking at this page you agree to stalking cookies” nonsense: https://jvn.jp/en/jp/JVN87751554/ https://jvn.jp/en/jp/JVN87751554/
yabones 5y ago
> A remote administrator can rewrite existing files on the file system and execute arbitrary code on the target system. If they're administrator, can't they just log in and use the root shell to do whatever the hell they want? Yes, it's a bug, but is it really a vulnerability?
georgia_peach 5y ago
I used to use this until I got fed-up with impedance mismatches between `pf` and the PfSense web GUI. Switched to an OpenBSD base installation a few years ago and haven't looked back. pf.conf is very user-friendly, the BSD docs for it are great, and it's nice being able to put everything directly under source control. Diffing individual conf files is a lot prettier than those massive PFSense XMLs.
- paulnpace 5y ago
  The problem I arrive at is I need non-tech peoples to fix problems without my being onsite. CLI support over the phone is a non-starter. Also, that XML file works forever, as best I can tell. Just for testing, I've installed backups from 7 years ago and they load just fine, which is also something a non-tech people can perform, even without calling me.
  - georgia_peach 5y ago
    My experience has been that taking away the noob interface reduces the number of incidents. How quickly a little sleuthing will turn an "I didn't change anything!" into "But, I didn't think that would make a difference." If it's something extra-special important, a POTS line and a modem make an excellent plan-B.
    - paulnpace 5y ago
      > My experience has been that taking away the noob interface reduces the number of incidents. And this doesn't also reduce the number of customers?
      - georgia_peach 5y ago
        I'm in the software business, not IT. Having it quietly work for years on end is a win for me.

122 points by pelasaco 5y ago

The "specially crafted request" is just dumb when you realize it means "a string with a semicolon" or such. Was sadly hoping this phrase had died.

q1w2 5y ago
This is just standard netsec jargon.
- hansel_der 5y ago
  a semicolon can be considered a 'special' character alright ...

0x0000000 5y ago

> Can this vulnerability be exploited remotely? > Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Arnavion 5y ago
I would hope nobody's opening up the admin interface to the internet. It's certainly not the default. The pfSense / OPNsense codebase is not written to be secure against malicious users in general, even unauthenticated ones that can't get past the login screen. For example I'm pretty sure php-fpm does nothing to prevent slow-loris. (The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.)
- vladvasiliu 5y ago
  > (The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.) Also, at least in OPNsense, for some reason, not all interfaces get an IP in the DNS. So if you want to access the admin interface via a name with a certificate, it may not always work if you selectively enable the listening interfaces. I've had this happened a week ago, where the DNS name wouldn't resolve to the internal interface's IP for some reason... I would only get the WAN interface and some other restricted one I have.
  - Arnavion 5y ago
    Change the Unbound settings to only listen on LAN interfaces, or even just one specific LAN interface. Eg I have four LAN interfaces but have Unbound configured to only listen on LAN1, so my router FQDN only resolves to the IPs of LAN1.
- pelasaco 5y ago
  I think the scenario isn't people hitting it through internet, but some attack chain involving, for instance a clickjacking, XSRF, XSS,etc in another website that try to access the UI in case the admin is authenticated in the firewall, visits the malicious website.
- suifbwish 5y ago
  I have never been able to figure out the intent of random slow loris attacks I’ve seen and mitigated on small networks I’ve worked on. It’s just random IPs connecting to the webserver for no reason other than to jam it. It’s not even a competition thing it’s like having a super soaker full of superglue and just spraying it up in the air blindfolded.
dogecoinbase 5y ago
Not great, but also a bit it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway.
donmcronald 5y ago
> This vulnerability can be exploited by a remote authenticated privileged user via the Internet. I don’t get it. If you’re authenticated as a privileged user, don’t you have access anyway?
- dspillett 5y ago
  When holes like this are exploited it is in combination with other flaws like another app having an XSS flaw which allows a rogue script to make arbitrary connections. If you happen to have an active login session on the admin interface, that script could use the hole to make changes unbeknownst to you. Also in a situation where you have admins with different levels of access, exploits like this could allow an individual low on gruntles to create a privilege escalation situation and gain access to features they should not. So a low probability of exploit due to the mitigating factor, but a high potential for damage if an exploit is attempted and succeeds.

cerved 5y ago

multiple means 2

dspillett 5y ago
Multiple means 2 or more, which includes 2. I'd have not used that wording either, but it is technically incorrect.

muppetman 5y ago

Please use Opnsense now, or something else entirely (Vyos is great but CLI based). I was a big pfSense fan, telling myself that the odd stuff Netgate did was normal/justified. Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now. Opnsense is a great replacement. I'm sure it's not perfect, but they're open, friendly, responsive and don't make you question every comment you write on their forum for fear of being banned.

robbiet480 5y ago
I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.
- lostlogin 5y ago
  There is some bad bad shit in that kit. The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great. I’d pay more if the software quality were better.
  - 8fingerlouie 5y ago
    > However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. I've been running a UDM and UDMP for years, and have literally never run into any of those issues, despite having a somewhat complex network (for a home network anyway). It runs 24/7 and only needs reboots when a software update requires it. Multiple VLANs, road warrior VPN. I run a site to site VPN between my UDMP at home and UDM at my summerhouse, and that has been rock solid as well. In the latest EA version of the software, there is also some support for Wireguard (though UI's Teleport). I'm not sure if "raw" Wireguard is available (yet). Latest version also implements policy based routing.

getcrunk 5y ago

2 vulnerabilities and both require access to the webgui.

resonanttoe 5y ago

JPCert has a better notification page (And the actual three, instead of dropping the Captive portal XSS) http://jvn.jp/en/jp/JVN87751554/index.html http://jvn.jp/en/jp/JVN87751554/index.html But these are all pretty lame "vulenrabilities".

dspillett 5y ago

Same information without “by looking at this page you agree to stalking cookies” nonsense: https://jvn.jp/en/jp/JVN87751554/ https://jvn.jp/en/jp/JVN87751554/

yabones 5y ago

> A remote administrator can rewrite existing files on the file system and execute arbitrary code on the target system. If they're administrator, can't they just log in and use the root shell to do whatever the hell they want? Yes, it's a bug, but is it really a vulnerability?

georgia_peach 5y ago

I used to use this until I got fed-up with impedance mismatches between `pf` and the PfSense web GUI. Switched to an OpenBSD base installation a few years ago and haven't looked back. pf.conf is very user-friendly, the BSD docs for it are great, and it's nice being able to put everything directly under source control. Diffing individual conf files is a lot prettier than those massive PFSense XMLs.

paulnpace 5y ago
The problem I arrive at is I need non-tech peoples to fix problems without my being onsite. CLI support over the phone is a non-starter. Also, that XML file works forever, as best I can tell. Just for testing, I've installed backups from 7 years ago and they load just fine, which is also something a non-tech people can perform, even without calling me.
- georgia_peach 5y ago
  My experience has been that taking away the noob interface reduces the number of incidents. How quickly a little sleuthing will turn an "I didn't change anything!" into "But, I didn't think that would make a difference." If it's something extra-special important, a POTS line and a modem make an excellent plan-B.
  - paulnpace 5y ago
    > My experience has been that taking away the noob interface reduces the number of incidents. And this doesn't also reduce the number of customers?
    - georgia_peach 5y ago
      I'm in the software business, not IT. Having it quietly work for years on end is a win for me.