ID:5703 - Exploit for XML External Entity injection in pfsense - CVE-2019-16701

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted methodCall XML document to the affected application and execute arbitrary OS commands on the system via the pfsense.exec_php call containing shell metacharacters in a parameter value.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Remediation