Multiple Vulnerabilities in PfSense

https://www.cybersecurity-help.cz/vdb/SB2022031507

by pelasaco • 4 years ago

122 61 4 years ago

0x0000000• 4 years ago

Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Arnavion4• 4 years ago

I would hope nobody's opening up the admin interface to the internet. It's certainly not the default. The pfSense / OPNsense codebase is not written to be secure against malicious users in general, even unauthenticated ones that can't get past the login screen. For example I'm pretty sure php-fpm does nothing to prevent slow-loris.

(The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.)

vladvasiliu• 4 years ago

(The admin interface listens on all network interfaces, including all WAN interfaces. However the default firewall rules black-hole all incoming traffic on the WAN interfaces.)

Also, at least in OPNsense, for some reason, not all interfaces get an IP in the DNS. So if you want to access the admin interface via a name with a certificate, it may not always work if you selectively enable the listening interfaces.

I've had this happened a week ago, where the DNS name wouldn't resolve to the internal interface's IP for some reason... I would only get the WAN interface and some other restricted one I have.

pelasaco• 4 years ago

I think the scenario isn't people hitting it through internet, but some attack chain involving, for instance a clickjacking, XSRF, XSS,etc in another website that try to access the UI in case the admin is authenticated in the firewall, visits the malicious website.

suifbwish• 4 years ago

I have never been able to figure out the intent of random slow loris attacks I’ve seen and mitigated on small networks I’ve worked on. It’s just random IPs connecting to the webserver for no reason other than to jam it. It’s not even a competition thing it’s like having a super soaker full of superglue and just spraying it up in the air blindfolded.

dogecoinbase• 4 years ago

Not great, but also a bit it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway.

donmcronald3• 4 years ago

This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

I don’t get it. If you’re authenticated as a privileged user, don’t you have access anyway?

dspillett3• 4 years ago

When holes like this are exploited it is in combination with other flaws like another app having an XSS flaw which allows a rogue script to make arbitrary connections. If you happen to have an active login session on the admin interface, that script could use the hole to make changes unbeknownst to you.

Also in a situation where you have admins with different levels of access, exploits like this could allow an individual low on gruntles to create a privilege escalation situation and gain access to features they should not.

So a low probability of exploit due to the mitigating factor, but a high potential for damage if an exploit is attempted and succeeds.

cerved• 4 years ago

multiple means 2

dspillett3• 4 years ago

Multiple means 2 or more, which includes 2.

I'd have not used that wording either, but it is technically incorrect.

muppetman4• 4 years ago

Please use Opnsense now, or something else entirely (Vyos is great but CLI based).

I was a big pfSense fan, telling myself that the odd stuff Netgate did was normal/justified.

Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now.

Opnsense is a great replacement. I'm sure it's not perfect, but they're open, friendly, responsive and don't make you question every comment you write on their forum for fear of being banned.

robbiet480• 4 years ago

I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.

lostlogin2• 4 years ago

There is some bad bad shit in that kit.

The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great.

I’d pay more if the software quality were better.

vigilans• 4 years ago

Ubiquiti is also morally questionable. They do not contribute their modifications to the Linux kernel as required by the GPL.

Maybe that has changed but I'm not aware that it has.

8fingerlouie4• 4 years ago

(Vyos is great but CLI based)

The best firewalls/routers i've ever used have been Vyos (or Vyatta) based.

Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor.

It does have a learning curve though :)

I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.

donmcronald3• 4 years ago

like the Ubiquiti Edgerouters of old.

Wasn’t EdgeOS a fork of Vyatta?

muppetman4• 4 years ago

Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too)

Long live the CLI :)

btgeekboy• 4 years ago

Are you aware of any trustworthy, free VyOS builds? I'd be interested in trying it out at home, but I'm not interested in paying $6k/year or using an unstable nightly. I tried building it myself once but didn't have time to get it working locally.

m1gu3l• 4 years ago

Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now.

This sounds fun. do you know where I can read more?

edit: think i found a good start https://www.reddit.com/r/networking/comments/m6zjie/wireguar...

Arnavion4• 4 years ago

HN thread: https://news.ycombinator.com/item?id=26475519

Events in chronological order:

- zx2c4 points out the brokenness of the Netgate implementation and his efforts to fix it: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

- ... which ends up being published by Ars: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-...

- Netgate throws a fit, zx2c4 responds: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

- FreeBSD maintainer of the WireGuard implementation announces Netgate's implementation will be removed: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

- Netgate's damage control / copium response: https://www.netgate.com/blog/painful-lessons-learned-in-secu...

- FreeBSD dev steps down from further involvement with WireGuard-in-FreeBSD: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

Arnavion4• 4 years ago

I switched before the WireGuard fiasco, when they announced they were EOLing the CE line, but weasel-worded to avoid having to use the phrase "EOL".

https://news.ycombinator.com/item?id=27775408

https://news.ycombinator.com/item?id=26479725

edge-records• 4 years ago

Just read the blog post from Netgate, sounds to me like they have decent values. Also them asking to keep safe disclosure procedures doesn't sound insane to me either. Beyond that it's a he said she said thing IMHO, and I don't have the time to get involved in any of that. Stuff happens between people, and them not managing to work it out doesn't per se mean they are evil or "insane".

I'm an Open Source user of pfSense (so they don't get money from me) but I still had an extremely helpful experience recently, when I had a feature request. Once I filed it, it was implemented quickly, MUCH better support than I could ever expect from a paid commercial firewall. Also the product runs reliably and is very stable since years. So I won't look for alternatives any time soon.

newsclues• 4 years ago

Netgate pissed off the open source absolutists, who mostly don’t give netgate money.

While I understand their complaints, I don’t understand the constant attacks and hate, as anyone who doesn’t want to support pfsense if there is a paid and a free oss version, is welcome to start a fork or work on other projects.

lausbub• 4 years ago

I just found these tools that help with migration. They pretty print the configuration XMLs such that one can transfer the settings manually through the GUI step by step and finally verify with the second tool.

https://github.com/TKCERT/pfFocus

https://github.com/AndyX90/OPNReport

https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/ti...

exmadscientist• 4 years ago

But don't use these if your configuration is simple enough that you can manually recreate it, on the completely-impossibly-rare chance that pfSense has managed to subtly bork itself and you're switching to OPNsense to get a more reliable device....

stock_toaster• 4 years ago

I switched to openwrt a few years ago, after a brief stint of using an edge router from ubiquity. vyos is nice, but openwrt is surprisingly solid too!

sigio• 4 years ago

Same here, always recommend openwrt when asked for home / office routers/firewalls.

q1w23• 4 years ago

Their hardware has not been reliable. We've purchased 4 devices from them for our medium sized business - and 2 of them failed completely within 5 years. Maybe both failures were anomalies, but these were the only two commercial grade devices we've had that failed in that same period.

1MachineElf• 4 years ago

I'm not sure what these devices are based on, but there was a time when a lot of the Netgate lineup was using Intel C2000-series Avoton CPUs. Down the road it was discovered all of those were susceptible to a hardware big known at AVR54. Could it be why your devices failed? More info here: https://www.servethehome.com/intel-atom-c2000-series-bug-qui...

tedunangst• 4 years ago

The "specially crafted request" is just dumb when you realize it means "a string with a semicolon" or such. Was sadly hoping this phrase had died.

q1w23• 4 years ago

This is just standard netsec jargon.

hansel_der• 4 years ago

a semicolon can be considered a 'special' character alright ...

getcrunk• 4 years ago

2 vulnerabilities and both require access to the webgui.

resonanttoe• 4 years ago

JPCert has a better notification page (And the actual three, instead of dropping the Captive portal XSS) http://jvn.jp/en/jp/JVN87751554/index.html

But these are all pretty lame "vulenrabilities".

dspillett3• 4 years ago

Same information without “by looking at this page you agree to stalking cookies” nonsense: https://jvn.jp/en/jp/JVN87751554/

yabones• 4 years ago

A remote administrator can rewrite existing files on the file system and execute arbitrary code on the target system.

If they're administrator, can't they just log in and use the root shell to do whatever the hell they want? Yes, it's a bug, but is it really a vulnerability?

georgia_peach3• 4 years ago

I used to use this until I got fed-up with impedance mismatches between `pf` and the PfSense web GUI. Switched to an OpenBSD base installation a few years ago and haven't looked back.

pf.conf is very user-friendly, the BSD docs for it are great, and it's nice being able to put everything directly under source control. Diffing individual conf files is a lot prettier than those massive PFSense XMLs.

paulnpace2• 4 years ago

The problem I arrive at is I need non-tech peoples to fix problems without my being onsite. CLI support over the phone is a non-starter. Also, that XML file works forever, as best I can tell. Just for testing, I've installed backups from 7 years ago and they load just fine, which is also something a non-tech people can perform, even without calling me.

georgia_peach3• 4 years ago

My experience has been that taking away the noob interface reduces the number of incidents. How quickly a little sleuthing will turn an "I didn't change anything!" into "But, I didn't think that would make a difference."

If it's something extra-special important, a POTS line and a modem make an excellent plan-B.

Multiple Vulnerabilities in PfSense

Related Stories