-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-25_02.webgui Security Advisory pfSense Topic: OpenVPN Management Interface Command Injection from OpenVPN Status and Dashboard Widget Category: pfSense Base System Module: webgui Announced: 2025-05-16 Credits: Github user NavyTitanium CVE ID: CVE-2024-54780 Affects: pfSense Plus software versions < 25.03 pfSense CE software versions < 2.8.0 Corrected: 2024-12-02 18:18:35 UTC (pfSense Plus master, 25.03) 2024-12-02 18:18:35 UTC (pfSense CE master, 2.8.0) 0. Revision History v1.0 2025-05-16 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential authenticated OpenVPN management interface command injection was identified in the OpenVPN status page and the OpenVPN Dashboard widget. When users perform operations via the OpenVPN status page (/status_openvpn.php) or the Dashboard widget (/widgets/widgets/openvpn.widget.php), those pages sent user input from the "remipp" variable to the OpenVPN management socket without validation. This problem is present on pfSense Plus version 24.11, pfSense CE version 2.7.2, and earlier versions of both. III. Impact A malicious client with sufficient privileges to access these pages can manipulate the content of the "remipp" variable to send additional arbitrary OpenVPN management commands through the management socket. This is restricted to OpenVPN management interface commands only. It is not possible to execute shell commands or arbitrary PHP code using this method. Output from the OpenVPN management commands is not returned to the user, but the commands can perform actions such as changing the log verboseness or causing the daemon to exit, resulting in a denial of service. Changes made using these commands do not persist across restarts of a OpenVPN daemons. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Limit access to the affected pages to trusted administrators only. * Use other VPN types (e.g. IPsec, WireGuard) V. Solution Users can upgrade to pfSense Plus software version 24.11 or later, or pfSense CE software versions after 2.7.2 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 24.03 and pfSense CE version 2.7.2 may apply the fix from the recommended patches list in the System Patches package. Users may also manually apply the relevant revisions below using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision - - ------------------------------------------------------------------------- plus/plus-master 92a55a0ad8976975b320bdff11f0512f59d3a2ab pfSense/master 92a55a0ad8976975b320bdff11f0512f59d3a2ab - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmgnYzIACgkQE7mH/ZIU +NpF/A/+Iad51sXvT3Rljf895q/vNrrb0xdR/QiZz0lU6bI2rXZ1ju3cQevEc/1+ k/Fq7mvkXiCFD3ACzhTLxparL3YL+FMJGojxdfWKn5XHJf4yLJ+yW7s+0HC0Ej+u xF3Bnv9BVFd5VlTPyjlcKurnDBmxQzZ5d8CjN93BCkDnEXPCV2ZMk4YzNSBfo6ig KILlQP5rELLR1dXP6V0RFOb3eURkbocs8wgdWr1O+VyYdBmhEko9V/XbG//lVh7L lvuUaT/QwY/Z1cKEVjZdNLPcAMVkGGrVRpIee87cwrp05zui1h8FtM66+RHWHjz+ tXH85wOe0m6LLxF/Ng61gBBw97DhgqyY4idBFat0/x9BvmARXdeQtygXecs8KOWK ZoPUXUgOZkJDv8rTuJ1h8wIjHXN/DDZCHOU5EzL9QEkNp3VQmTORuPYA+9Jd8shr 2EE26A0s6sXhvdA/5qz+kIiOBwQ7l7cCWmLjwhboOCPNTEj1kz0I0HJLt+3c5JfQ EmdHtv+Vv+5qOtcr18sO4CPZqQxKq5Qzz5tAv4r4HjG5xCOvhxoedoo6XOvKya18 GMwUP7Nq4AWlEH7eDmQMXgwcmf/SIPTVDqCSNrM7sdZbGH8qXGUqYA3/GcAHG/ax yPQepkSTh45QTY5znMUOk4vo+xBDw0XCbT5YZkoyeCU63Hc6QSk= =biUv -----END PGP SIGNATURE-----