Vulnerability Description
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netgate | Pfsense | <= 2.4.1 |
| Opnsense Project | Opnsense | < 16.1.16 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2017/11/22/7ExploitMailing ListThird Party Advisory
- https://doc.pfsense.org/index.php/2.4.2_New_Features_and_ChangesIssue TrackingVendor Advisory
- https://github.com/opnsense/core/commit/d218b225PatchThird Party Advisory
- https://github.com/pfsense/pfsense/commit/386d89b07PatchThird Party Advisory
- https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-aThird Party Advisory
- https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csExploitThird Party Advisory
- http://www.openwall.com/lists/oss-security/2017/11/22/7ExploitMailing ListThird Party Advisory
- https://doc.pfsense.org/index.php/2.4.2_New_Features_and_ChangesIssue TrackingVendor Advisory
- https://github.com/opnsense/core/commit/d218b225PatchThird Party Advisory
- https://github.com/pfsense/pfsense/commit/386d89b07PatchThird Party Advisory
- https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-aThird Party Advisory
- https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csExploitThird Party Advisory
FAQ
What is CVE-2017-1000479?
CVE-2017-1000479 is a vulnerability with a CVSS score of 8.8 (HIGH). pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame...
How severe is CVE-2017-1000479?
CVE-2017-1000479 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-1000479?
Check the references section above for vendor advisories and patch information. Affected products include: Netgate Pfsense, Opnsense Project Opnsense.