CVE-2021-41282: pfSense RCE Vulnerability via Sed Injection

CVE-2021-41282 Overview

CVE-2021-41282 is a command injection vulnerability in pfSense 2.5.2 that affects the diag_routes.php component. The vulnerability allows authenticated users to inject sed-specific code through the diagnostic routes functionality, enabling arbitrary file writes to any location on the system.

The vulnerability exists in how pfSense processes routing table data. While the application employs common protection mechanisms against command injection—specifically the use of the escapeshellarg function for arguments—an attacker can still inject sed-specific commands. This injection vector allows writing arbitrary files to arbitrary locations on the target system, potentially leading to remote code execution.

Critical Impact

Authenticated attackers can leverage sed data injection to write arbitrary files to any location on the pfSense firewall, potentially achieving full system compromise through shell upload.

Affected Products

• pfSense 2.5.2
• pfSense versions prior to 22.01 (2.6.0)

Discovery Timeline

• 2022-03-01 - CVE CVE-2021-41282 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-41282

Vulnerability Analysis

The vulnerability resides in diag_routes.php, a diagnostic page that allows authenticated users to view routing information on the pfSense firewall. The page retrieves routing data by executing the netstat utility and parses its output using the sed utility.

Despite the implementation of escapeshellarg to sanitize command-line arguments and prevent traditional command injection, the developers did not account for sed-specific injection vectors. This oversight allows attackers to craft malicious input that, while properly escaped for shell execution, contains valid sed commands that get interpreted during the parsing phase.

The sed utility's powerful text processing capabilities can be abused to write content to arbitrary files on the filesystem. An attacker with valid authentication credentials can exploit this to upload a web shell or modify critical system files, ultimately achieving remote code execution on the firewall.

Root Cause

The root cause is improper injection prevention (CWE-74) where the application fails to account for sed-specific command syntax during input validation. While shell argument escaping prevents direct command injection, the input is subsequently passed to sed where specialized syntax can alter program behavior. The sed utility supports the w command for writing output to files, which can be abused when attacker-controlled input reaches sed processing.

Attack Vector

The attack requires network access and valid authentication credentials to the pfSense web interface. An authenticated attacker can send crafted requests to diag_routes.php containing sed commands embedded in the routing filter parameters. The malicious sed code bypasses the escapeshellarg protection because it remains syntactically valid shell content while achieving code execution within the sed interpreter context.

The attack flow involves:

1. Authenticating to the pfSense web interface
2. Navigating to the diagnostic routes functionality
3. Injecting sed-specific commands through filter parameters
4. The injected sed commands write arbitrary content to a web-accessible location
5. Accessing the uploaded shell to achieve remote code execution

For detailed exploitation information, see the Shielder pfSense RCE Advisory and Packet Storm Security Exploit.

Detection Methods for CVE-2021-41282

Indicators of Compromise

• Unexpected files appearing in web-accessible directories (e.g., /usr/local/www/)
• Web shells or PHP files with suspicious names in the pfSense webroot
• Unusual POST requests to diag_routes.php with encoded or malformed parameters
• Authentication logs showing access to diagnostic pages followed by suspicious file system activity

Detection Strategies

• Monitor HTTP access logs for requests to diag_routes.php containing unusual characters or encoded payloads
• Implement file integrity monitoring on the pfSense web directory to detect unauthorized file creation
• Review authentication logs for unusual login patterns, especially to administrative interfaces
• Deploy network-based detection for POST requests to diagnostic endpoints with sed-specific syntax patterns

Monitoring Recommendations

• Enable comprehensive logging for the pfSense web interface and review logs regularly
• Configure alerts for new file creation in web-accessible directories
• Monitor for outbound connections from the pfSense firewall to unusual destinations, which may indicate post-exploitation activity
• Implement network segmentation to limit access to the pfSense administrative interface

How to Mitigate CVE-2021-41282

Immediate Actions Required

• Upgrade pfSense to version 22.01 (2.6.0) or later immediately
• Restrict access to the pfSense web interface to trusted networks and IP addresses only
• Audit existing user accounts and remove unnecessary administrative access
• Review web server directories for unexpected files that may indicate prior compromise

Patch Information

Netgate has addressed this vulnerability in pfSense version 22.01 (2.6.0). The fix implements proper input validation to prevent sed-specific injection attacks. Administrators should update to the latest available pfSense version as soon as possible.

For official patch information and release notes, see the Netgate pfSense Release Notes.

Workarounds

• Restrict access to the pfSense web administration interface using firewall rules to allow only trusted IP addresses
• Implement multi-factor authentication for administrative access where possible
• Consider disabling or restricting access to diagnostic pages for non-administrative users
• Deploy a web application firewall (WAF) in front of the pfSense interface to filter malicious requests

# Example: Restrict pfSense web interface access via firewall rules
# Add these rules to limit admin interface access to specific trusted IPs

# Block all external access to admin port
iptables -A INPUT -p tcp --dport 443 -j DROP

# Allow only trusted management network
iptables -I INPUT -s 192.168.1.0/24 -p tcp --dport 443 -j ACCEPT