Netgate pfSense CE CRLF Injection in DNS Resolver

Executive Summary

This vulnerability is a CRLF injection flaw in Netgate pfSense CE versions 2.7.1 through 2.9.0. It allows authenticated users with DNS Resolver: Advanced privileges to inject malicious Unbound directives by embedding CR/LF characters in the unvalidated sock_queue_timeout parameter. The injected input is written directly into the unbound.conf file without sanitization, enabling attackers to override local DNS records and forwarding settings for all clients.

Useful 0 Not Useful 0

Detection Guidance

Check pfSense versions between 2.7.1 and 2.9.0 for the vulnerable file services_unbound_advanced.php. Inspect the sock_queue_timeout parameter in the Unbound configuration for unexpected CR/LF characters or malicious directives.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate DNS settings to redirect traffic, bypass security controls, or cause denial of service. They might override local records to redirect users to malicious sites or alter forwarding settings to disrupt network operations. The impact depends on the attacker's goals and network configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized changes in DNS configurations, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Compromised DNS settings might expose sensitive data or disrupt critical services, leading to compliance violations and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update pfSense to a patched version beyond 2.9.0. If immediate update is not possible, restrict access to the WebGUI's advanced DNS resolver settings and monitor for unauthorized configuration changes.

Useful 0 Not Useful 0