Vendor disputes seriousness of firewall plugin RCE flaw

guest · Sep 8, 2022

By John Leyden @jleyden - September 8, 2022

Security researchers from IHTeam have uncovered a serious vulnerability in a plugin to the pfSense firewall technology.

The affected pfBlockerNG plugin is not installed by default and the problem was, in any case, resolved by a software update published in June.
Click to expand...

This is just as well because the underlying flaw created an unauthenticated remote code execution (RCE) as root risk on affected installations, according to IHTeam. The pfSense pfBlockerNG vulnerability is tracked as CVE-2022-31814.
Root cause analysis
pfSense is a firewall/router software distribution based on FreeBSD. The open source-based network firewall technology can be installed on bare metal or as a virtual appliance.
Click to expand...

pfBlockerNG is a plugin component available within pfSense that will facilitate allow-listing or deny-listing of entire IP ranges. It is often used to block entire countries from communicating with networks running pfSense, according to researchers, who point out several factors that call particular attention to the problem.

“The vulnerability is a remote command execution exploitable from an unauthenticated perspective and, on top of that, the web server is running with root privileges,” a representation of IHTeam told The Daily Swig.
Click to expand...

Accordingly to Shodan, there are around 27,000 exposed pfSense machines on the internet. This should not be taken as any indication of the number of vulnerable systems since many will not be running the affected pfBlockerNG plugin, without considering that even vulnerable installations have likely been patched since the software was updated.
Click to expand...

Netgate stated that for the problem to become exposed “requires access to the web server on the firewall (which should never be open on WAN and is often restricted internally when configured per best practices), the overall practical impact was considered extremely low despite it having a high score in theory.”

IHTeam came across the vulnerability in pfBlockerNG during an independent security assessment of what turned out to be a vulnerable version of the product. A technical write-up of the issue was published in a blog post by IHTeam on Monday (September 5).
Click to expand...

Log in or Sign up

Vendor disputes seriousness of firewall plugin RCE flaw

guest Guest

Log in or Sign up

Vendor disputes seriousness of firewall plugin RCE flaw

guest Guest

Useful Searches