Executive Summary

This vulnerability exists in the pfSense Snort package, specifically in the file snort_ip_reputation.php. The iplist parameter is not properly sanitized to remove directory traversal characters before checking if a file exists. Although an attacker cannot read file contents, they can determine whether arbitrary files exist on the server by exploiting this flaw. The attacker must be authenticated with at least 'WebCfg - Services: Snort package' permissions to exploit this. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated attacker to enumerate files on the server by checking for their existence without proper input validation. This can lead to information disclosure about the server's file structure, which may aid further attacks or reconnaissance. However, the attacker cannot read the contents of the files. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the directory traversal in the iplist parameter of the Snort package's snort_ip_reputation.php page while authenticated with appropriate permissions. A test could involve sending crafted POST requests to /usr/local/www/snort/snort_ip_reputation.php with iplist values containing directory traversal strings (e.g., ../../etc/passwd) and observing if the server reveals whether such files exist. Specific commands could include using curl or similar tools to send such POST requests and checking the response for file existence indications. For example: curl -X POST -d "iplist=../../etc/passwd" https://<pfsense-ip>/snort/snort_ip_reputation.php --cookie "<auth-cookie>". Note that authentication with "WebCfg - Services: Snort package" permissions is required. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the pfSense Snort package to a version that contains the fix for this vulnerability. The fix is included in pfSense Plus versions 25.07.1 and 25.07, and Community Edition versions 2.8.1 and 2.8.0. The update restricts file existence checks to the designated IP reputation directory, preventing directory traversal attacks. Until the update is applied, restrict access to the Snort package web interface to trusted users only, ensuring that only authenticated users with the necessary permissions can access it. [1, 2]

Useful 0 Not Useful 0