Command injection in OPNsense - #VU142551

Vulnerability details

The vulnerability allows a remote user to execute arbitrary OpenVPN management protocol commands.

The vulnerability exists due to command injection in the OpenVPN session kill endpoint and backend kill_session.py script when handling a crafted session_id parameter containing newline characters. A remote privileged user can send a specially crafted request to execute arbitrary OpenVPN management protocol commands.

The injected commands are written to the OpenVPN management unix socket as root, and exploitation can terminate, restart, or otherwise control the VPN daemon. An authenticated VPN peer may also reach the same injection path through a crafted certificate common name when an operator kills its session.

Affected software

Remediation

External References

• https://github.com/opnsense/core/security/advisories/GHSA-fqmm-g6xw-qhm4

Related Security Bulletins

• Multiple vulnerabilities in OPNsense