OS Command Injection in Netgate pfSense CE QinQ Interface Configuration

Netgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection vulnerability within the QinQ interface configuration module. The vulnerability exists due to improper validation of the parent interface name field when editing a QinQ entry. An authenticated attacker with sufficient privileges (QinQ edit access) can provide a crafted input string that is improperly sanitized and subsequently passed to the underlying ifconfig shell command. When the system processes the interface configuration, the injected command is executed with root privileges, leading to full system compromise. This issue highlights the risks associated with improper input handling in network appliance management interfaces.

Impact

Successful exploitation allows an authenticated user to elevate their access level to root on the affected pfSense firewall, enabling full control over the network device, data interception, and persistence mechanisms. This affects all installations of pfSense CE versions 2.7.0 through 2.9.0.

Recommendation

Prioritize the update of all affected pfSense CE installations to a version beyond 2.9.0 once the vendor releases a patch. As an immediate mitigation, review administrative access logs and restrict the 'QinQ edit' privilege to only highly trusted and necessary accounts to minimize the potential attack surface.