abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · pfsense-config-readonly-restore
Class: Privilege leftover Reach: Remote
pfSense CE 2.9.0-DEVELOPMENT ( 9363ac5 ) - pfsense.org
write_config honors user-config-readonly. config_install and config_restore replace config.xml without that check.
I pinned public master 9363ac5 . The lab is a PHP gadget of the pinned sink, loopback HTTP on 127.0.0.1:19200 .
Series write-up:
What an attacker can do
Requires: a page that can call config_install / config_restore while Deny Config Write is set . CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Requires: a page that can call config_install / config_restore while Deny Config Write is set . CSRF-magic on POST unless noted. WebGUI PHP-FPM is root. CSRF-magic on POST unless noted. WebGUI PHP-FPM is root.
Adjacent surface that stays closed
Normal config writes stay denied.
No Diagnostics: Command unless that page is also granted.
Loopback 127.0.0.1:19200 . Compose project pfsense-config-readonly-restore . Witness PFSENSE-CONFIG-READONLY-RESTORE-WITNESS . Loopback only: 127.0.0.1:19200 . Compose project pfsense-config-readonly-restore . Witness PFSENSE-CONFIG-READONLY-RESTORE-WITNESS . PHP gadget of the pinned lines. Stack tears down after the run.
Honor user-config-readonly in config_install and config_restore.
github.com/pfsense/pfsense 9363ac5b8651a1c7a333180425ce7719070f95f9
Series:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
