pfSense limiter module CVE-2024-3318 High-Severity Arbitrary File Inclusion Vulnerability Advisory

Vulnerability Overview Vulnerability Name: pfSense-limiter-number Vulnerability ID: CVE-2024-3918 CVSS Score: 8.1 (High) Vulnerability Type: Arbitrary File Inclusion Affected Component: "Limiter" feature module of the pfSense firewall Vulnerability Description: Attackers can craft malicious requests to exploit a file inclusion vulnerability within the pfSense limiter functionality, enabling them to read arbitrary files on the server (such as , , etc.), and potentially execute arbitrary code. This vulnerability allows unauthorized users to trigger file inclusion via the web interface, thereby obtaining sensitive information or further compromising the system. --- Scope of Impact Affected Versions: pfSense 2.7.x and earlier versions (specific versions subject to official announcements) Affected Platforms: All hardware devices running pfSense (x86, ARM, etc.) Attack Surface: Access via the Web management interface to "System > Package Manager > pfBlockerNG" or related limiter configuration pages Potential Risks: - Reading system configuration files (e.g., , ) - Potential for Remote Code Execution (RCE) - Data leakage, privilege escalation, and loss of system control --- Remediation Official Patch: Upgrade to the latest stable version of pfSense (recommended to update immediately to version 2.7.2 or higher) Temporary Mitigation Measures: - Restrict IP access to the Web management interface (allow only trusted networks) - Disable unnecessary limiter features or turn off related services - Use firewall rules to block direct access to paths such as Monitoring Recommendations: Review logs for abnormal file access records (e.g., frequent reads of ) --- POC / Exploit Code > Note: Actual exploitation requires obtaining a valid session Cookie (acquired by logging into the management interface). Replace and with actual values to trigger the vulnerability. --- Additional Information Disclosure Date: June 2024 Reporter: Security Researcher (Anonymous) Related Resources: - GitHub Project - Official Security Advisory - NVD Entry --- ✅ Recommended Action: Immediately upgrade the pfSense system and review all limiter-related configurations.

Goal Reached Thanks to every supporter — we hit 100%!

pfSense limiter module CVE-2024-3318 High-Severity Arbitrary File Inclusion Vulnerability Advisory

More from this source