Here's the page we think you wanted. See search results instead:

pfSense pfBlockerNG Host Header Command Injection

Strike ID:
E23-epv41
CVSS:
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
2
Year:
2022

Description

This strike exploits a command injection vulnerability in Netgate pfSense pfBlockerNG. This vulnerability is due to improper input validation for the Host HTTP header. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in OS command injection in the context of root.

CVE

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40624

References

https://github.com/dhammon/pfBlockerNg-CVE-2022-40624