CVE-2018-16055 : What You Need to Know

A vulnerability in pfSense version prior to 2.4.4 allows authenticated attackers to execute arbitrary commands as the root user through the WebGUI.

Understanding CVE-2018-16055

What is CVE-2018-16055?

An authenticated command injection vulnerability exists in pfSense before version 2.4.4, specifically in the status_interfaces.php file, enabling attackers with authenticated access to execute arbitrary commands as the root user.

The Impact of CVE-2018-16055

The vulnerability arises from unsanitized user input from specific POST parameters, allowing attackers to exploit the WebGUI privileges and execute commands in the root user's context.

Technical Details of CVE-2018-16055

Vulnerability Description

The vulnerability in pfSense version prior to 2.4.4 resides in the dhcp_relinquish_lease() function within the status_interfaces.php file, enabling command injection due to improper sanitization of user input.

Affected Systems and Versions

Product: pfSense
Vendor: N/A
Versions Affected: Prior to 2.4.4

Exploitation Mechanism

Attackers can exploit this vulnerability by submitting a request to relinquish a DHCP lease for an interface configured to obtain its address via DHCP, leveraging the unsanitized "ifdescr" and "ipv" POST parameters.

Mitigation and Prevention

Immediate Steps to Take

Upgrade pfSense to version 2.4.4 or later to mitigate the vulnerability.
Restrict access to the WebGUI to authorized users only.

Long-Term Security Practices

Regularly monitor security advisories and updates for pfSense.
Implement strong authentication mechanisms and access controls to prevent unauthorized access.

Patching and Updates

Apply patches and updates provided by pfSense to address security vulnerabilities.