Description
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opnsense core
Default version status: unaffected
0 to < 26.7.8affected26.7.8unaffected
References
- https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p ↗
- https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47 ↗
- https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73 ↗
- https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa ↗
- https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165 ↗
- https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed ↗
- https://github.com/opnsense/core ↗
- https://www.vulncheck.com/advisories/opnsense-before-26.7.8-root-command-injection-via-firmware-mirror-setting ↗