Signature Detail

HTTP: Netgate pfSense system_advanced_misc.php Command Injection

This signature detects attempts to exploit a known vulnerability against Netgate pfSense system.e. Successful exploitation results in the execution of arbitrary commands as the root user on the target server.

Extended Description

An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_normal_mode` parameter.

Affected Products

• Netgate pfsense 2.4.4

References

• CVE: CVE-2018-4019
• URL: https://talosintelligence.com/vulnerability_reports/talos-2018-0690
• URL: https://www.pfsense.org/security/advisories/pfsense-sa-18_09.webgui.asc