Summary
A command injection vulnerability in pfSense CE's Captive Portal high-availability synchronization functionality allows a privileged user to influence data used in a system command. When attacker-controlled XML-RPC responses provide crafted connected-user fields, the resulting command may execute with root privileges.
A command injection vulnerability in pfSense CE's Captive Portal high-availability synchronization functionality allows a privileged user to influence data used in a system command. When attacker-controlled XML-RPC responses provide crafted connected-user fields, the resulting command may execute with root privileges.
Affected context
The vulnerability occurs in pfSense CE deployments that use Captive Portal high-availability synchronization and process connected-user data received from a configured synchronization endpoint. Risk increases when a user has the Captive Portal HA privilege and the endpoint can return untrusted values that reach firewall-management command construction without adequate escaping.
The vulnerability occurs in pfSense CE deployments that use Captive Portal high-availability synchronization and process connected-user data received from a configured synchronization endpoint. Risk increases when a user has the Captive Portal HA privilege and the endpoint can return untrusted values that reach firewall-management command construction without adequate escaping.
Exploit preconditions
- Attack surface: Captive Portal high-availability synchronization and its XML-RPC data-processing path
- Required access: A pfSense account with the Captive Portal HA privilege, or equivalent ability to influence the synchronization configuration
- Trigger point: Processing connected-user records during captive portal firewall rule handling
- Why exploitation is possible: Values from remote synchronization data can reach a shell command without reliable separation between data and command syntax
- Attack surface: Captive Portal high-availability synchronization and its XML-RPC data-processing path
- Required access: A pfSense account with the Captive Portal HA privilege, or equivalent ability to influence the synchronization configuration
- Trigger point: Processing connected-user records during captive portal firewall rule handling
- Why exploitation is possible: Values from remote synchronization data can reach a shell command without reliable separation between data and command syntax
Why this happens
The underlying bug is an OS command injection caused by incorporating externally influenced ip or mac field values into a shell command without sufficient escaping or structured argument handling. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because data intended as command arguments can be interpreted as shell syntax.
The underlying bug is an OS command injection caused by incorporating externally influenced ip or mac field values into a shell command without sufficient escaping or structured argument handling. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because data intended as command arguments can be interpreted as shell syntax.
Potential impact
- An attacker may execute arbitrary commands with root privileges
- The pfSense firewall appliance could be fully compromised
- Configuration, traffic-control, and authentication data could be altered
- Network traffic could be redirected, blocked, or monitored
- The compromised appliance could be used to access connected systems
- An attacker may execute arbitrary commands with root privileges
- The pfSense firewall appliance could be fully compromised
- Configuration, traffic-control, and authentication data could be altered
- Network traffic could be redirected, blocked, or monitored
- The compromised appliance could be used to access connected systems
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from being interpreted by a shell and reducing the privileges available to command-processing components.
Common defensive patterns include:
- Prefer direct system APIs or argument-array process execution over shell command construction
- Apply strict allowlist validation for IP and MAC address fields before processing
- Treat XML-RPC synchronization data as untrusted, even when it originates from an administratively configured endpoint
- Separate data validation from command execution and reject malformed records by default
- Restrict Captive Portal HA privileges and synchronization endpoints according to least privilege
- Limit the firewall appliance's ability to reach unnecessary management or internal services
Mitigation generally focuses on preventing untrusted values from being interpreted by a shell and reducing the privileges available to command-processing components.
Common defensive patterns include:
- Prefer direct system APIs or argument-array process execution over shell command construction
- Apply strict allowlist validation for IP and MAC address fields before processing
- Treat XML-RPC synchronization data as untrusted, even when it originates from an administratively configured endpoint
- Separate data validation from command execution and reject malformed records by default
- Restrict Captive Portal HA privileges and synchronization endpoints according to least privilege
- Limit the firewall appliance's ability to reach unnecessary management or internal services
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules for string concatenation or interpolation used to build shell commands
- Code review checks for subprocess or shell invocation with externally sourced values
- Searches for firewall-management commands receiving unsanitized XML-RPC, HTTP, or configuration data
- Runtime monitoring for unexpected root processes, command interpreters, or changes to firewall rules
- Policy enforcement requiring structured process APIs, strict input schemas, and allowlisted network-identity formats
- Automated security review tools that flag shell invocation and missing input validation
Detection approaches commonly include:
- Static analysis rules for string concatenation or interpolation used to build shell commands
- Code review checks for subprocess or shell invocation with externally sourced values
- Searches for firewall-management commands receiving unsanitized XML-RPC, HTTP, or configuration data
- Runtime monitoring for unexpected root processes, command interpreters, or changes to firewall rules
- Policy enforcement requiring structured process APIs, strict input schemas, and allowlisted network-identity formats
- Automated security review tools that flag shell invocation and missing input validation
