CVE-2023-38997
📋 TL;DR
A directory traversal vulnerability in OPNsense's Captive Portal templates allows attackers to upload crafted ZIP archives that can execute arbitrary system commands as root. This affects OPNsense Community Edition before version 23.7 and Business Edition before version 23.4.2. Attackers can achieve remote code execution with root privileges on vulnerable systems.
💻 Affected Systems
- OPNsense Community Edition
- OPNsense Business Edition
📦 What is this software?
Opnsense by Opnsense
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing attackers to install persistent backdoors, exfiltrate sensitive data, pivot to internal networks, or disrupt network operations.
Likely Case
Remote code execution leading to network compromise, credential theft, and potential lateral movement within the network infrastructure.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires access to upload functionality in Captive Portal templates. Technical details and proof-of-concept are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition 23.7+, Business Edition 23.4.2+
Vendor Advisory: https://github.com/opnsense/core/commit/448762d440b51574f1906c0ec2f5ea6dc4f16eb2
Restart Required: No
Instructions:
1. Update OPNsense via System → Firmware → Updates. 2. Click 'Check for updates'. 3. Install available updates. 4. Reboot if prompted.
🔧 Temporary Workarounds
Disable Captive Portal
allTemporarily disable the Captive Portal feature if not required.
Restrict Access
allImplement network access controls to limit who can access the Captive Portal interface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OPNsense management interfaces from untrusted networks.
- Deploy web application firewall (WAF) rules to detect and block directory traversal attempts in file uploads.
🔍 How to Verify
Check if Vulnerable:
Check OPNsense version via web interface (System → Firmware → Status) or CLI: 'opnsense-version'.Check Version:
opnsense-versionVerify Fix Applied:
Confirm version is Community Edition 23.7+ or Business Edition 23.4.2+. Verify patch commit 448762d is applied.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Captive Portal templates directory
- Suspicious command execution patterns in system logs
- Failed directory traversal attempts in web server logs
Network Indicators:
- Unexpected outbound connections from OPNsense appliance
- Anomalous traffic patterns to/from Captive Portal interface
SIEM Query:
source="opnsense" AND (event="file_upload" OR event="command_execution") AND (path="*../*" OR user="root")