Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-41282.
PoCs published by Abdel Adim, Oisfi of Shielder, jbaines-r7, including Metasploit module exploits/unix/http/pfsense_diag_routes_webshell.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2021-41282, an arbitrary file creation vulnerability in pfSense's HTTP interface, allowing authenticated users with specific privileges to upload a PHP web shell and execute commands with root privileges.
Description
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.
Exploits (1)
This Metasploit module exploits CVE-2021-41282, an arbitrary file creation vulnerability in pfSense's HTTP interface, allowing authenticated users with specific privileges to upload a PHP web shell and execute commands with root privileges.
Nuclei Templates (1)
http.title:"pfsense - login"
title="pfsense - login"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H