CVE-2023-39003
📋 TL;DR
This CVE involves insecure permissions in the /tmp directory of OPNsense firewall appliances, allowing local attackers to potentially escalate privileges or execute arbitrary code. It affects OPNsense Community Edition before version 23.7 and Business Edition before 23.4.2. The vulnerability stems from improper access controls that could be exploited by authenticated users.
💻 Affected Systems
- OPNsense Community Edition
- OPNsense Business Edition
📦 What is this software?
Opnsense by Opnsense
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to root compromise of the firewall appliance, allowing complete system takeover, configuration modification, and potential lateral movement to internal networks.
Likely Case
Authenticated user gains elevated privileges to modify system files, install backdoors, or access sensitive configuration data on the firewall.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized file access within /tmp directory without privilege escalation.
🎯 Exploit Status
Exploitation requires local authenticated access. The vulnerability involves predictable directory permission issues that could be exploited with standard privilege escalation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition 23.7+, Business Edition 23.4.2+
Vendor Advisory: http://opnsense.com
Restart Required: No
Instructions:
1. Log into OPNsense web interface. 2. Navigate to System > Firmware > Updates. 3. Click 'Check for updates'. 4. Install available updates. 5. For manual update: ssh to appliance and run 'opnsense-update'.
🔧 Temporary Workarounds
Temporary /tmp permissions hardening
linuxManually adjust /tmp directory permissions to restrict access while awaiting patch
chmod 1777 /tmp
chown root:wheel /tmp
🧯 If You Can't Patch
- Restrict SSH and console access to only trusted administrators
- Implement strict monitoring of /tmp directory access and file creation patterns
🔍 How to Verify
Check if Vulnerable:
Check OPNsense version via web interface (System > Firmware > Status) or CLI with 'opnsense-version'. Verify if version is below patched versions.Check Version:
opnsense-versionVerify Fix Applied:
After update, verify version is 23.7+ (Community) or 23.4.2+ (Business). Check /tmp permissions with 'ls -ld /tmp' - should show drwxrwxrwt.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation in /tmp by non-root users
- Permission modification attempts on /tmp directory
- Failed privilege escalation attempts in system logs
Network Indicators:
- Unusual SSH connections to firewall followed by file system activity
- Unexpected configuration changes to firewall rules
SIEM Query:
source="opnsense" AND (event="permission_denied" OR event="file_create" AND path="/tmp/*")