Summary
A high-severity privilege escalation vulnerability in the pfSense REST API package allows authenticated users with a dedicated settings-sync permission to alter REST API configuration secrets. A non-administrative account may thereby gain full administrator privileges when the HA settings synchronization endpoint does not enforce an administrator-only boundary.
A high-severity privilege escalation vulnerability in the pfSense REST API package allows authenticated users with a dedicated settings-sync permission to alter REST API configuration secrets. A non-administrative account may thereby gain full administrator privileges when the HA settings synchronization endpoint does not enforce an administrator-only boundary.
Affected context
The issue affects pfSense CE or pfSense Plus deployments using pfSense-pkg-RESTAPI versions before 2.9.0 where:
- A non-administrative account has the dedicated REST API settings-sync permission
- The HA settings synchronization endpoint accepts that scoped privilege
- REST API configuration secrets can be modified through the synchronization workflow
Exposure depends on the deployment's account permissions, API access controls, and network reachability.
The issue affects pfSense CE or pfSense Plus deployments using pfSense-pkg-RESTAPI versions before 2.9.0 where:
- A non-administrative account has the dedicated REST API settings-sync permission
- The HA settings synchronization endpoint accepts that scoped privilege
- REST API configuration secrets can be modified through the synchronization workflow
Exposure depends on the deployment's account permissions, API access controls, and network reachability.
Exploit preconditions
- Attack surface: The pfSense REST API HA settings synchronization endpoint
- Required access: An authenticated account holding the dedicated settings-sync permission
- Trigger point: Processing a settings synchronization request that modifies REST API configuration secrets
- Why exploitation is possible: The endpoint permits a sub-administrative privilege to perform an operation that should be restricted to full administrators, allowing the account to cross the intended privilege boundary
- Attack surface: The pfSense REST API HA settings synchronization endpoint
- Required access: An authenticated account holding the dedicated settings-sync permission
- Trigger point: Processing a settings synchronization request that modifies REST API configuration secrets
- Why exploitation is possible: The endpoint permits a sub-administrative privilege to perform an operation that should be restricted to full administrators, allowing the account to cross the intended privilege boundary
Why this happens
The underlying issue is an authorization-boundary failure involving security-sensitive serialized or configuration data. A narrowly scoped permission is treated as sufficient to modify REST API secrets, even though that operation can influence authentication and authorization behavior.
This is associated with CWE-502: Deserialization of Untrusted Data as reported for the vulnerability. The broader insecure pattern is allowing lower-trust, user-controlled configuration synchronization to affect privileged application state without enforcing an administrator-only authorization check.
The underlying issue is an authorization-boundary failure involving security-sensitive serialized or configuration data. A narrowly scoped permission is treated as sufficient to modify REST API secrets, even though that operation can influence authentication and authorization behavior.
This is associated with CWE-502: Deserialization of Untrusted Data as reported for the vulnerability. The broader insecure pattern is allowing lower-trust, user-controlled configuration synchronization to affect privileged application state without enforcing an administrator-only authorization check.
Potential impact
- A non-administrative user may gain full administrator privileges
- An attacker could modify firewall or API configuration
- Administrative accounts, secrets, or access policies could be exposed or altered
- Network security controls could be weakened
- The compromised firewall could facilitate persistence or lateral movement
- A non-administrative user may gain full administrator privileges
- An attacker could modify firewall or API configuration
- Administrative accounts, secrets, or access policies could be exposed or altered
- Network security controls could be weakened
- The compromised firewall could facilitate persistence or lateral movement
General mitigation guidance
Mitigation centers on restoring a strict authorization boundary around HA settings synchronization and sensitive REST API configuration.
Common defensive patterns include:
- Requiring full administrative authorization for settings-sync operations
- Removing the dedicated settings-sync privilege from non-administrative accounts
- Restricting API endpoints with explicit ACLs and firewall rules
- Limiting endpoint access to trusted administrator and HA peer addresses
- Applying least privilege to API identities and separating synchronization from general API access
- Using secure-by-default API exposure and opt-in access for sensitive functionality
- Validating configuration formats and security-sensitive fields before applying changes
These controls reduce exposure without relying solely on the secrecy of configuration values.
Mitigation centers on restoring a strict authorization boundary around HA settings synchronization and sensitive REST API configuration.
Common defensive patterns include:
- Requiring full administrative authorization for settings-sync operations
- Removing the dedicated settings-sync privilege from non-administrative accounts
- Restricting API endpoints with explicit ACLs and firewall rules
- Limiting endpoint access to trusted administrator and HA peer addresses
- Applying least privilege to API identities and separating synchronization from general API access
- Using secure-by-default API exposure and opt-in access for sensitive functionality
- Validating configuration formats and security-sensitive fields before applying changes
These controls reduce exposure without relying solely on the secrecy of configuration values.
How teams detect issues like this
Organizations can look for this issue through:
- Auditing accounts that hold the REST API settings-sync privilege
- Reviewing authorization rules for HA synchronization and secret-management endpoints
- Monitoring API requests that modify REST API configuration or synchronization state
- Alerting on configuration changes originating from non-administrative identities or unexpected source addresses
- Applying static and policy analysis to identify endpoints where scoped permissions can modify privileged configuration
- Reviewing code for missing administrator checks before applying synchronized settings
Automated access-control testing and API security scanners can help identify privilege-boundary violations during development and assessment.
Organizations can look for this issue through:
- Auditing accounts that hold the REST API settings-sync privilege
- Reviewing authorization rules for HA synchronization and secret-management endpoints
- Monitoring API requests that modify REST API configuration or synchronization state
- Alerting on configuration changes originating from non-administrative identities or unexpected source addresses
- Applying static and policy analysis to identify endpoints where scoped permissions can modify privileged configuration
- Reviewing code for missing administrator checks before applying synchronized settings
Automated access-control testing and API security scanners can help identify privilege-boundary violations during development and assessment.
