NetSPI found a high-risk pfBlockerNG flaw on pfSense that could let a crafted DNS reply poison logs and trigger stored XSS in the webConfigurator, ultimately leading to remote code execution as root. Netgate rapidly shipped a fix after disclosure, and the issue was later assigned a CVE following validation by NetSPI. #pfBlockerNG #pfSense #Netgate #NetSPI #webConfigurator #CVE
Keypoints
- NetSPI discovered a high-risk vulnerability chain in pfBlockerNG, a widely installed pfSense package used for DNS-based blocking and IP firewall rules.
- The issue affected the Unbound Python mode and DNS Reply Logging, allowing unsafe DNS reply data to be written into log files.
- A crafted DNS reply could inject JavaScript into pfSense reports, creating a stored Cross-Site Scripting condition in the web management portal.
- The most effective sink was the aggregated Stats page, where poisoned log data was rendered without proper escaping and could persist beyond the 200-row DNS Reply table view.
- If an administrator viewed the malicious page, the payload could load attacker-controlled JavaScript and abuse pfSense command execution functionality to achieve RCE.
- Successful exploitation could expose firewall configuration, credentials, and traffic, and could also allow firewall rule, DNS, and routing manipulation.
- Netgate released a fix within hours of disclosure, and the patch introduced input sanitization to prevent unsafe content from being stored in logs.
MITRE Techniques
- [T1189 ] Drive-by Compromise – Malicious content is delivered through a crafted DNS reply that later executes when an administrator views the poisoned report page (‘a stored Cross-Site Scripting (XSS) attack’).
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The attacker’s JavaScript posts a shell command and launches a reverse shell on the appliance (‘downloads and runs a reverse shell script’).
- [T1185 ] Browser Session Hijacking – The attacker-controlled JavaScript fetches /diag_command.php and steals a CSRF token from the admin’s browser context (‘scrapes a CSRF token from the response’).
- [T1190 ] Exploit Public-Facing Application – The pfSense web management portal is abused through the vulnerable pfBlockerNG reporting interface (‘store JavaScript on a number of pages on the pfSense web management portal’).
- [T1056.003 ] Input Capture: Web Portal Capture – The injected script extracts a CSRF token from the portal response before issuing privileged requests (‘scrapes a CSRF token from the response’).
Indicators of Compromise
- [File names] pfBlockerNG DNS reply logs and report data – /var/log/pfblockerng/dns_reply.log, /var/log/pfblockerng/unified.log
- [File path] pfSense command execution endpoint targeted by the payload – /diag_command.php
- [Package/version] Fixed pfBlockerNG release referenced in the disclosure timeline – v. 3.2.16_1, pfBlockerNG
- [HTTP content / payload type] Stored XSS payload content delivered in a DNS TXT reply and rendered in reports – crafted TXT record, external JavaScript file