发布 2016-04-14 漏洞条目

pfSense Firewall 2.2.6 – Services Cross-Site Request Forgery

Exploit Source

# Exploit Title: pfSense Firewall <= 2.2.6 Cross-Site Request Forgery

# Exploit Author: Aatif Shahdad

# Software Link: http://files.nyi.pfsense.org/mirror/downloads/old/pfSense-LiveCD-2.2.5-RELEASE-i386.iso.gz

# Version: 2.2.6 and below.

# Contact: https://twitter.com/61617469665f736

# Category: webapps

1. Description

An attacker can coerce a logged-in victim's browser to issue requests that will start/stop/restart services on the Firewall.

2. Proof of Concept

Start NTPD service:

<html>

<body>

</form>

</body>

</html>

Stop NTPD service:

<html>

<body>

</form>

</body>

</html>

Restart NTPD service:

POC:

<html>

<body>

</form>

</body>

</html>

The service will automatically start/stop.

Note: That NTPD service can be replaced with any service running on the Firewall. For example, to stop the APINGER (gateway monitoring daemon) service, use the following POC:

<html>

<body>

</form>

</body>

</html>

3. Solution:

Upgrade to version 2.3 at https://www.pfsense.org/download/mirror.php?section=downloads

作者: Aatif Shahdad
日期: 2016-04-14
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection