This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Remote Command Execution (RCE) via **Command Injection**. π **Consequences**: Attackers can run arbitrary OS commands on the firewall/router.β¦
π‘οΈ **Root Cause**: **Command Injection** flaw. The `graph` parameter in `status_rrd_graph_img.php` is not sanitized. It allows the `|` character to inject shell commands directly into the system execution context.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **pfSense** versions **prior to 2.3**. π’ **Vendor**: Electric Sheep Fencing. π₯οΈ **Component**: The Web GUI component handling RRD graph images.
Q4What can hackers do? (Privileges/Data)
π **Capabilities**: Hackers gain **Remote Code Execution (RCE)**. π **Privileges**: Commands run with the privileges of the web server process (often root/system level on BSD).β¦
β οΈ **Threshold**: **Low**. π **Auth**: Likely requires access to the Web GUI (which may be unauthenticated if default or misconfigured, or authenticated if admin access is leaked).β¦
π₯ **Public Exp**: **YES**. π **Sources**: Exploit-DB ID **39709** and Rapid7 Metasploit module `pfsense_graph_injection_exec` are available. π **Wild Exploitation**: High risk due to available PoCs.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for pfSense Web GUI. π§ͺ **Test**: Send a request to `status_rrd_graph_img.php` with `graph` parameter containing `|` (e.g., `|id`).β¦
π§ **No Patch Workaround**: 1. Restrict Web GUI access via IP whitelist. π« 2. Disable unnecessary Web GUI features. π 3. Use a WAF to block `|` characters in GET/POST parameters targeting `status_rrd_graph_img.php`.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL**. π¨ **Priority**: **P1**. RCE vulnerabilities in firewalls are high-impact. Immediate patching to v2.3+ is strongly recommended to prevent total network takeover.