Executive brief
Packetfence is a network access control platform used to manage and authenticate devices connecting to corporate networks. An authenticated administrator can inject arbitrary commands through the network interface configuration settings in the web administration console, leading to remote code execution with root privileges on the Packetfence server. This allows a malicious or compromised admin account to take complete control of the system and all connected network infrastructure.
Technical details
A command injection vulnerability exists in Packetfence's network interface configuration API endpoint (/api/v1/config/interfaces). The vulnerable code in Interface.pm constructs a system command using unsanitized user input from the VLAN ID field, executing `sudo ip link add` with attacker-controlled parameters. The vulnerability is reachable only by authenticated administrators with access to the configuration API. By injecting shell metacharacters (such as semicolons and command substitution) into the VLAN field, an attacker can break out of the intended command and execute arbitrary shell commands with sudo privileges. The application relies only on client-side validation. The vulnerability was fixed in Packetfence 14.0 and later versions.
Affected products
- Packetfence Packetfence 13.2.0
Timeline
- 2024: disclosed: Vulnerability discovered and reported by ly1g3
- 2024: patched: Fixed in Packetfence 14.0