Summary
Netgate pfSense CE contains an authorization bypass in configuration management functions that do not consistently honor the "Config: Deny Config Write" privilege. A read-only WebGUI user with access to certain configuration or backup pages may replace the system configuration, potentially enabling root-level code execution after a reload or reboot.
Netgate pfSense CE contains an authorization bypass in configuration management functions that do not consistently honor the "Config: Deny Config Write" privilege. A read-only WebGUI user with access to certain configuration or backup pages may replace the system configuration, potentially enabling root-level code execution after a reload or reboot.
Affected context
The issue may occur in pfSense CE deployments where:
- A user has read-only WebGUI access but retains page privileges for configuration, backup, or restore functions
- Configuration-management handlers process an uploaded or selected
config.xml - The relevant write-denial privilege is not enforced consistently by the underlying configuration functions
Risk depends on the WebGUI authorization model, assigned page privileges, and whether a modified configuration can be installed and activated.
The issue may occur in pfSense CE deployments where:
- A user has read-only WebGUI access but retains page privileges for configuration, backup, or restore functions
- Configuration-management handlers process an uploaded or selected
config.xml - The relevant write-denial privilege is not enforced consistently by the underlying configuration functions
Risk depends on the WebGUI authorization model, assigned page privileges, and whether a modified configuration can be installed and activated.
Exploit preconditions
- Attack surface: Authenticated pfSense WebGUI configuration and backup interfaces
- Required access: A WebGUI account with access to one or more affected configuration-management pages
- Trigger point: Processing and installation of a replacement
config.xml, followed by a configuration reload or system restart - Why exploitation is possible: The configuration functions do not reliably enforce the user's config-write restriction, allowing a lower-privileged account to perform an administrative configuration operation
- Attack surface: Authenticated pfSense WebGUI configuration and backup interfaces
- Required access: A WebGUI account with access to one or more affected configuration-management pages
- Trigger point: Processing and installation of a replacement
config.xml, followed by a configuration reload or system restart - Why exploitation is possible: The configuration functions do not reliably enforce the user's config-write restriction, allowing a lower-privileged account to perform an administrative configuration operation
Why this happens
The underlying flaw is an authorization enforcement gap. Page-level access checks and the "User - Config: Deny Config Write" privilege are not consistently applied by config_restore() and config_install(), allowing a caller who reaches those functions to perform a configuration replacement operation.
This maps to CWE-863: Incorrect Authorization, where an application fails to enforce the intended permission policy before carrying out a protected action. Because the configuration can influence privileged system behavior, bypassing the write restriction may extend beyond ordinary data modification.
The underlying flaw is an authorization enforcement gap. Page-level access checks and the "User - Config: Deny Config Write" privilege are not consistently applied by config_restore() and config_install(), allowing a caller who reaches those functions to perform a configuration replacement operation.
This maps to CWE-863: Incorrect Authorization, where an application fails to enforce the intended permission policy before carrying out a protected action. Because the configuration can influence privileged system behavior, bypassing the write restriction may extend beyond ordinary data modification.
Potential impact
- A user with limited WebGUI privileges may alter firewall and system settings
- The installed configuration could cause services to run with attacker-controlled behavior
- A successful attack may enable root-level code execution after reload or reboot
- Network security controls, administrative access, or monitoring could be weakened
- The appliance may be rendered unavailable or its configuration integrity may be compromised
- A user with limited WebGUI privileges may alter firewall and system settings
- The installed configuration could cause services to run with attacker-controlled behavior
- A successful attack may enable root-level code execution after reload or reboot
- Network security controls, administrative access, or monitoring could be weakened
- The appliance may be rendered unavailable or its configuration integrity may be compromised
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the operation boundary rather than relying only on page visibility or upstream checks.
Common defensive patterns include:
- Require an explicit configuration-write permission immediately before restore or installation operations
- Apply the same authorization policy consistently across upload, restore, backup, and reload workflows
- Use deny-by-default access for configuration-management pages and sensitive administrative actions
- Separate read-only backup access from privileges that can install or activate configurations
- Validate configuration provenance and integrity before applying it
- Run privileged configuration operations with narrowly scoped service permissions
- Record and alert on configuration replacement, restore, and reload events
Mitigation generally focuses on enforcing authorization at the operation boundary rather than relying only on page visibility or upstream checks.
Common defensive patterns include:
- Require an explicit configuration-write permission immediately before restore or installation operations
- Apply the same authorization policy consistently across upload, restore, backup, and reload workflows
- Use deny-by-default access for configuration-management pages and sensitive administrative actions
- Separate read-only backup access from privileges that can install or activate configurations
- Validate configuration provenance and integrity before applying it
- Run privileged configuration operations with narrowly scoped service permissions
- Record and alert on configuration replacement, restore, and reload events
How teams detect issues like this
Organizations can assess this class of issue through:
- Static analysis and code review checks that compare page authorization with authorization inside privileged helper functions
- Review of all callers to configuration restore, install, reload, and backup routines
- Tests using restricted accounts to verify that denied privileges remain effective across every configuration path
- Policy checks requiring explicit authorization before accepting or activating administrative configuration files
- Audit-log monitoring for configuration replacement or reload events performed by non-administrative accounts
Automated security testing and code-review tools may help identify authorization checks that are missing, inconsistent, or performed only at the user-interface layer.
Organizations can assess this class of issue through:
- Static analysis and code review checks that compare page authorization with authorization inside privileged helper functions
- Review of all callers to configuration restore, install, reload, and backup routines
- Tests using restricted accounts to verify that denied privileges remain effective across every configuration path
- Policy checks requiring explicit authorization before accepting or activating administrative configuration files
- Audit-log monitoring for configuration replacement or reload events performed by non-administrative accounts
Automated security testing and code-review tools may help identify authorization checks that are missing, inconsistent, or performed only at the user-interface layer.
