pfSense/ACB Cloud Vulnerabilities: CVE-2020-19527 XSS, Command Injection, XML Injection

Critical Vulnerability Information 1. ACB Cloud Backup Key Hijack & Stored XSS Affected Product: ACB Cloud (v2.0 beta release and later versions) Vulnerability Type: XML External Entity Injection, Command Injection, and Stored XSS CVE ID: CVE-2020-19527 Impact: - Attackers can exploit backup key hijacking to access cloud backup data. - Stored XSS allows attackers to execute malicious JavaScript code when administrators browse the backup page. 2. OpenVPN Widget Command Injection Affected Product: OpenVPN Widget (v2.0 beta release and later versions) Vulnerability Type: Command Injection CVE ID: CVE-2020-18506 Impact: - Attackers can send specially crafted POST requests to exploit unvalidated user input and execute arbitrary commands. - The vulnerability enables attackers to execute system commands via the OpenVPN management interface. 3. XML Injection in Dashboard Widgets Affected Product: pfSense CE (v2.0 beta release and later versions) Vulnerability Type: XML Injection CVE ID: CVE-2020-18779 Impact: - Attackers can exploit XML injection to modify configuration files, leading to service disruption or privilege escalation. - Specific XML structures can bypass filters and inject malicious data into configuration files. Timeline ACB Cloud Backup Key Hijack & Stored XSS - 2020-11-15: Vulnerability reported to security@netgate.com - 2020-12-12: Vulnerability confirmed - 2020-12-24: CVE assigned OpenVPN Widget Command Injection - 2020-11-15: Vulnerability reported to security@netgate.com - 2020-12-12: Vulnerability confirmed - 2020-12-24: CVE assigned XML Injection in Dashboard Widgets - 2020-11-15: Vulnerability reported to security@netgate.com - 2020-12-12: Vulnerability confirmed - 2020-12-24: CVE assigned

Goal Reached Thanks to every supporter — we hit 100%!

pfSense/ACB Cloud Vulnerabilities: CVE-2020-19527 XSS, Command Injection, XML Injection