Summary
A command injection vulnerability in the pfSense FRR status filter allows an authenticated WebGUI user with limited status-page access to influence shell commands executed by the FRR package.
When crafted filter input reaches the vulnerable command pipeline, attacker-controlled commands may execute with root privileges on the firewall.
A command injection vulnerability in the pfSense FRR status filter allows an authenticated WebGUI user with limited status-page access to influence shell commands executed by the FRR package.
When crafted filter input reaches the vulnerable command pipeline, attacker-controlled commands may execute with root privileges on the firewall.
Affected context
The issue occurs in the pfSense FRR package's status-filter functionality when:
- The FRR package is deployed in an affected pfSense environment
- An authenticated WebGUI user has the page-status-frr privilege
- User-controlled filter data is incorporated into a shell command
- The resulting command is executed through a process pipeline with elevated privileges
Risk depends on access to the affected WebGUI function and the privileges assigned to the account.
The issue occurs in the pfSense FRR package's status-filter functionality when:
- The FRR package is deployed in an affected pfSense environment
- An authenticated WebGUI user has the page-status-frr privilege
- User-controlled filter data is incorporated into a shell command
- The resulting command is executed through a process pipeline with elevated privileges
Risk depends on access to the affected WebGUI function and the privileges assigned to the account.
Exploit preconditions
- Attack surface: pfSense WebGUI FRR status page
- Required access: An authenticated account with the page-status-frr privilege
- Trigger point: Processing of the FRR status filter by the backend command pipeline
- Why exploitation is possible: Filter input can alter the intended shell expression despite escaping applied to the concatenated value, allowing shell metacharacter processing and command substitution
- Execution context: The vulnerable operation may run with root privileges
- Attack surface: pfSense WebGUI FRR status page
- Required access: An authenticated account with the page-status-frr privilege
- Trigger point: Processing of the FRR status filter by the backend command pipeline
- Why exploitation is possible: Filter input can alter the intended shell expression despite escaping applied to the concatenated value, allowing shell metacharacter processing and command substitution
- Execution context: The vulnerable operation may run with root privileges
Why this happens
The vulnerability results from constructing a shell command by combining user-controlled filter input with a quoted sed expression and then passing the result to a popen() pipeline.
Although escapeshellarg() is used on part of the value, the surrounding command construction leaves a shell interpretation boundary that can be influenced by crafted input. This is an instance of CWE-78: Improper Neutralization of Special Elements used in an OS Command, where data is incorporated into an interpreter command without preserving a strictly non-executable data context.
The vulnerability results from constructing a shell command by combining user-controlled filter input with a quoted sed expression and then passing the result to a popen() pipeline.
Although escapeshellarg() is used on part of the value, the surrounding command construction leaves a shell interpretation boundary that can be influenced by crafted input. This is an instance of CWE-78: Improper Neutralization of Special Elements used in an OS Command, where data is incorporated into an interpreter command without preserving a strictly non-executable data context.
Potential impact
- An attacker may execute arbitrary operating-system commands
- Commands could run with root-level privileges
- The firewall configuration and security controls could be modified
- Network traffic may be redirected, monitored, or disrupted
- Credentials, secrets, and sensitive system data could be exposed
- The compromised device could be used to affect connected networks
- An attacker may execute arbitrary operating-system commands
- Commands could run with root-level privileges
- The firewall configuration and security controls could be modified
- Network traffic may be redirected, monitored, or disrupted
- Credentials, secrets, and sensitive system data could be exposed
- The compromised device could be used to affect connected networks
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from request-processing paths and reducing the privileges available to status operations.
Common defensive patterns include:
- Replacing shell pipelines with direct library or process APIs that pass arguments as structured values
- Avoiding dynamic command construction from WebGUI input
- Applying strict allowlists for filter syntax and permitted values
- Validating input before command construction and keeping validation independent of shell parsing
- Running status and diagnostic operations with the minimum privileges required
- Restricting WebGUI access through strong authentication, network controls, and narrowly assigned roles
- Treating escaping as defense in depth rather than as a substitute for eliminating shell invocation
Mitigation generally focuses on removing shell interpretation from request-processing paths and reducing the privileges available to status operations.
Common defensive patterns include:
- Replacing shell pipelines with direct library or process APIs that pass arguments as structured values
- Avoiding dynamic command construction from WebGUI input
- Applying strict allowlists for filter syntax and permitted values
- Validating input before command construction and keeping validation independent of shell parsing
- Running status and diagnostic operations with the minimum privileges required
- Restricting WebGUI access through strong authentication, network controls, and narrowly assigned roles
- Treating escaping as defense in depth rather than as a substitute for eliminating shell invocation
How teams detect issues like this
Detection approaches can include:
- Static analysis rules for
popen(), shell interpreters, command concatenation, and dynamicsedexpressions - Code review checks for user-controlled values crossing WebGUI-to-shell boundaries
- Searches for escaping functions combined with string concatenation rather than structured argument passing
- Runtime monitoring of unexpected child processes spawned by the pfSense WebGUI or FRR package
- Audit review for unusual status-page access, configuration changes, and privileged process activity
- Policy enforcement that blocks shell execution in request handlers unless explicitly justified
Automated code scanning and review tools may help identify similar command-construction patterns.
Detection approaches can include:
- Static analysis rules for
popen(), shell interpreters, command concatenation, and dynamicsedexpressions - Code review checks for user-controlled values crossing WebGUI-to-shell boundaries
- Searches for escaping functions combined with string concatenation rather than structured argument passing
- Runtime monitoring of unexpected child processes spawned by the pfSense WebGUI or FRR package
- Audit review for unusual status-page access, configuration changes, and privileged process activity
- Policy enforcement that blocks shell execution in request handlers unless explicitly justified
Automated code scanning and review tools may help identify similar command-construction patterns.
