Summary
Netgate pfSense CE contains an OS command injection vulnerability in Traffic Shaper Limiter handling. An authenticated user with Traffic Shaper Limiters privileges may tamper with a limiter number value and cause commands to run with root privileges when the limiter is deleted.
Netgate pfSense CE contains an OS command injection vulnerability in Traffic Shaper Limiter handling. An authenticated user with Traffic Shaper Limiters privileges may tamper with a limiter number value and cause commands to run with root privileges when the limiter is deleted.
Affected context
The vulnerability occurs in pfSense CE Traffic Shaper Limiter workflows when a user with the relevant limiter-management privilege can influence the hidden number field associated with a limiter. The risk is present when the value is later used by the limiter deletion logic to construct a shell command without adequate neutralization.
The vulnerability occurs in pfSense CE Traffic Shaper Limiter workflows when a user with the relevant limiter-management privilege can influence the hidden number field associated with a limiter. The risk is present when the value is later used by the limiter deletion logic to construct a shell command without adequate neutralization.
Exploit preconditions
- Attack surface: Authenticated pfSense web administration functionality - Required access: Traffic Shaper Limiters privileges - Trigger point: Deletion of a limiter after its number value has been
tampered with
- Why exploitation is possible: The value reaches delete_queue() and is
passed unquoted to dnctl through /bin/sh with root privileges
- Attack surface: Authenticated pfSense web administration functionality - Required access: Traffic Shaper Limiters privileges - Trigger point: Deletion of a limiter after its number value has been
tampered with
- Why exploitation is possible: The value reaches delete_queue() and is
passed unquoted to dnctl through /bin/sh with root privileges
Why this happens
The underlying flaw is OS command injection caused by incorporating attacker-influenced input into a shell command without safe argument handling. In this case, the limiter number field is trusted when constructing the command used by delete_queue(). This behavior maps to CWE-78 because shell metacharacters or additional command content may be interpreted rather than treated strictly as data.
The underlying flaw is OS command injection caused by incorporating attacker-influenced input into a shell command without safe argument handling. In this case, the limiter number field is trusted when constructing the command used by delete_queue(). This behavior maps to CWE-78 because shell metacharacters or additional command content may be interpreted rather than treated strictly as data.
Potential impact
- An authorized attacker may execute arbitrary commands as root
- The attacker could alter firewall, traffic-shaping, or system settings
- The compromise could expose or modify sensitive configuration data
- The system could be used to affect connected networks or services
- Persistence or further compromise could be possible depending on privileges
and deployment configuration
- An authorized attacker may execute arbitrary commands as root
- The attacker could alter firewall, traffic-shaping, or system settings
- The compromise could expose or modify sensitive configuration data
- The system could be used to affect connected networks or services
- Persistence or further compromise could be possible depending on privileges
and deployment configuration
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application-controlled operations. Prefer direct process or API invocation with fixed executables and separately supplied arguments, rather than composing command strings for a shell. Treat limiter identifiers as untrusted input, enforce strict allowlisted formats and bounds, and validate them before use. Where possible, use platform APIs for queue management, limit administrative privileges, and run related operations with the minimum permissions required.
Mitigation generally focuses on removing shell interpretation from application-controlled operations. Prefer direct process or API invocation with fixed executables and separately supplied arguments, rather than composing command strings for a shell. Treat limiter identifiers as untrusted input, enforce strict allowlisted formats and bounds, and validate them before use. Where possible, use platform APIs for queue management, limit administrative privileges, and run related operations with the minimum permissions required.
How teams detect issues like this
Detection can include static analysis for shell invocation, string concatenation, interpolation, or formatting involving request parameters. Code review should examine hidden form fields, deletion handlers, and any path that passes user-controlled values to system utilities. Runtime monitoring can look for unexpected shell children, unusual dnctl arguments, and root processes launched by the web administration service. Policy enforcement can require argument-safe process APIs, input allowlists, and security review for privileged command execution. Automated code-scanning tools may help identify related patterns.
Detection can include static analysis for shell invocation, string concatenation, interpolation, or formatting involving request parameters. Code review should examine hidden form fields, deletion handlers, and any path that passes user-controlled values to system utilities. Runtime monitoring can look for unexpected shell children, unusual dnctl arguments, and root processes launched by the web administration service. Policy enforcement can require argument-safe process APIs, input allowlists, and security review for privileged command execution. Automated code-scanning tools may help identify related patterns.
