CVE-2025-34173
📋 TL;DR
This vulnerability allows authenticated attackers with Snort package permissions to perform directory traversal attacks in pfSense CE's Snort IP reputation module. While file contents cannot be read, attackers can enumerate files on the system to discover sensitive information. Only pfSense CE installations with Snort package enabled and authenticated users with appropriate permissions are affected.
💻 Affected Systems
- pfSense CE
📦 What is this software?
Pfsense by Pfsense
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map the entire filesystem, discover configuration files, credentials, or other sensitive data locations, enabling further targeted attacks.
Likely Case
Attackers with legitimate Snort management access abuse their permissions to enumerate files, potentially discovering backup files, logs, or configuration data.
If Mitigated
With proper access controls and monitoring, impact is limited to information disclosure about file existence without content exposure.
🎯 Exploit Status
Exploitation requires authenticated access with specific permissions and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing commit d6f462bcc446969f8955c16cfde300d5c9ab7435
Vendor Advisory: https://redmine.pfsense.org/issues/16412
Restart Required: No
Instructions:
1. Update pfSense CE to latest version. 2. Apply the specific patch from GitHub commit d6f462bcc446969f8955c16cfde300d5c9ab7435. 3. No service restart required.
🔧 Temporary Workarounds
Restrict Snort Management Access
allLimit 'WebCfg - Services: Snort package' permissions to only essential administrators.
Disable Snort Package
allIf Snort functionality is not required, disable the package entirely.
🧯 If You Can't Patch
- Implement strict access controls for Snort management interface
- Monitor and audit access to /usr/local/www/snort/snort_ip_reputation.php endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your pfSense CE version predates commit d6f462bcc446969f8955c16cfde300d5c9ab7435 and has Snort package enabled.Check Version:
pfSense version from web interface or 'cat /etc/version' from shellVerify Fix Applied:
Verify the patch is applied by checking the snort_ip_reputation.php file for proper input sanitization of the iplist parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to snort_ip_reputation.php with directory traversal sequences in parameters
Network Indicators:
- HTTP requests containing '../' or similar traversal patterns to the Snort endpoint
SIEM Query:
web_access_logs WHERE url LIKE '%snort_ip_reputation.php%' AND (params CONTAINS '../' OR params CONTAINS '..\\')