CVE-2023-27253: Netgate pfSense RCE Vulnerability

CVE-2023-27253 Overview

A command injection vulnerability exists in the restore_rrddata() function of Netgate pfSense v2.7.0. This security flaw allows authenticated attackers to execute arbitrary commands on the underlying system by manipulating the contents of an XML file supplied to the config.xml component. The vulnerability stems from improper input sanitization when processing RRD (Round-Robin Database) data during backup restoration operations.

Critical Impact

Authenticated attackers can achieve full system compromise through arbitrary command execution on pfSense firewall appliances, potentially leading to complete network infrastructure takeover.

Affected Products

• Netgate pfSense v2.7.0
• pfSense installations using the RRD backup/restore functionality
• Systems where config.xml restoration is performed

Discovery Timeline

• 2023-03-17 - CVE-2023-27253 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-27253

Vulnerability Analysis

This command injection vulnerability exists within the restore_rrddata() function in pfSense's configuration library. The vulnerability is exploitable over the network and requires low privileges (authenticated user access). The flaw allows attackers with valid credentials to inject malicious commands through specially crafted XML content within the RRD data restoration process.

The vulnerable code path processes filenames from user-controlled XML input without proper sanitization before passing them to shell commands via PHP's exec() function. This creates a direct injection point where malicious payloads embedded in the filename parameter are executed with the privileges of the web server process.

Root Cause

The root cause is insufficient input validation and improper shell argument handling in two key areas:

1. Path Traversal via Filename: The $rrd['filename'] value from user-supplied XML was directly concatenated into file paths without using basename() to strip directory components
2. Command Injection via exec(): File paths were passed to the rrdtool command using simple string interpolation with single quotes instead of proper shell argument escaping via escapeshellarg()

The original vulnerable code constructed commands like:

exec("$rrdtool restore -f '{$xml_file}' '{$rrd_file}'", $output, $status);

This allowed attackers to break out of the quoted context and inject arbitrary shell commands through specially crafted filenames containing shell metacharacters.

Attack Vector

The attack vector involves an authenticated user with access to the pfSense backup/restore functionality. The attacker can craft a malicious configuration backup file containing a weaponized rrddata section with filenames designed to escape the shell command context and execute arbitrary commands.

The following patch demonstrates the security fix applied by Netgate:

 	foreach ($conf['rrddata']['rrddatafile'] as $rrd) {
 		if ($rrd['xmldata']) {
-			$rrd_file = "{$g['vardb_path']}/rrd/{$rrd['filename']}";
+			$rrd_file = "{$g['vardb_path']}/rrd/" . basename($rrd['filename']);
 			$xml_file = preg_replace('/\.rrd$/', ".xml", $rrd_file);
 			if (file_put_contents($xml_file, gzinflate(base64_decode($rrd['xmldata']))) === false) {
 				log_error(sprintf(gettext("Cannot write %s"), $xml_file));
 				continue;
 			}
 			$output = array();
 			$status = null;
-			exec("$rrdtool restore -f '{$xml_file}' '{$rrd_file}'", $output, $status);
+			exec("{$rrdtool} restore -f " . escapeshellarg($xml_file) . ' ' . escapeshellarg($rrd_file), $output, $status);
 			if ($status) {
 				log_error("rrdtool restore -f '{$xml_file}' '{$rrd_file}' failed returning {$status}.");
 				continue;
 			}
 			unlink($xml_file);
 		} else if ($rrd['data']) {
-			$rrd_file = "{$g['vardb_path']}/rrd/{$rrd['filename']}";
+			$rrd_file = "{$g['vardb_path']}/rrd/" . basename($rrd['filename']);
 			$rrd_fd = fopen($rrd_file, "w");
 			if (!$rrd_fd) {
 				log_error(sprintf(gettext("Cannot write %s"), $rrd_file));

Source: GitHub pfSense Commit

Detection Methods for CVE-2023-27253

Indicators of Compromise

• Unusual process spawning from the pfSense web server process (typically running as www or nobody)
• Suspicious entries in pfSense system logs related to RRD restore operations
• Unexpected shell commands or child processes associated with rrdtool execution
• Modified or suspicious config.xml backup files containing unusual characters in RRD filename fields
• Network connections originating from the pfSense appliance to unexpected external hosts

Detection Strategies

• Monitor authentication logs for suspicious backup restoration activity from unusual IP addresses or at unusual times
• Implement file integrity monitoring on the pfSense configuration directory (/cf/conf/)
• Deploy network detection rules to identify command injection patterns in HTTP POST requests to the pfSense web interface
• Analyze web server access logs for requests to backup/restore endpoints with anomalous parameters

Monitoring Recommendations

• Enable verbose logging for pfSense backup and restore operations
• Configure alerting for failed or suspicious RRD restore attempts in system logs
• Implement process monitoring to detect unexpected command execution from the web server context
• Review audit logs for configuration changes and backup restoration events

How to Mitigate CVE-2023-27253

Immediate Actions Required

• Upgrade pfSense to a patched version immediately
• Audit recent backup restoration activities for signs of exploitation
• Review user accounts with backup/restore privileges and remove unnecessary access
• Validate the integrity of any recently restored configuration backups

Patch Information

Netgate has released a security patch addressing this vulnerability. The fix implements two key security improvements:

1. Path Sanitization: The patch uses basename() to strip any directory components from user-supplied filenames, preventing path traversal attacks
2. Shell Argument Escaping: The patch replaces direct string interpolation with escapeshellarg() to properly escape shell arguments

The security fix is available in commit ca80d18. Additional details can be found in the pfSense Issue Tracker #13935.

Workarounds

• Restrict access to the pfSense backup/restore functionality to only trusted administrators
• Implement network-level access controls to limit which IP addresses can access the pfSense web interface
• Validate and sanitize any configuration backup files before restoration
• Consider disabling web-based backup restoration and use command-line tools with proper input validation instead

# Restrict web interface access to specific management networks
# Add to /etc/pf.conf or configure via pfSense GUI
# Example: Allow only trusted management subnet
pass in on $wan_if proto tcp from 10.0.0.0/24 to any port 443
block in on $wan_if proto tcp from any to any port 443