Description
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opnsense core
Default version status: unaffected
0 to < 26.7.8affected
pkg:github/opnsense/coreReferences
- https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68 ↗
- https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410 ↗
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232 ↗
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70 ↗
- https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv ↗
- https://abraxaslabs.tech/research/opnsense-lockout-factory-ip ↗
- https://github.com/opnsense/core ↗
- https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username ↗