Remote Code Execution Vulnerability in pfSense pfBlockerNG Product by Netgate
CVE-2022-31814

9.8CRITICAL

Key Information:

Vendor

Netgate

Status
Pfblockerng
Vendor
CVE Published:
5 September 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%

What is CVE-2022-31814?

The pfBlockerNG package for pfSense, version 2.1.4_26, is vulnerable to a remote code execution flaw that allows attackers to execute arbitrary OS commands as the root user. This vulnerability arises from inadequately sanitized input in the HTTP Host header, which can include shell metacharacters, leading to the execution of unintended commands. It's important to note that pfBlockerNG version 3.x is not affected. Users are advised to upgrade to a patched version to mitigate the risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

SenselessViolence
Created by EvergreenCartoons

CVE-2022-31814
Created by Chocapikk

RCE
Created by drcayber

References

https://docs.netgate.com/pfsense/en/latest/packages/pfblo...
https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vu...
http://packetstormsecurity.com/files/168743/pfSense-pfBlo...

EPSS Score

94% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.