Executive brief
A vulnerability exists in the Snort package for pfSense, a popular open-source firewall and routing platform. An authenticated user with access to Snort service settings can determine whether specific files exist on the underlying system, even if they shouldn't have access to those files. While the attacker cannot read the contents of the files, this information could be used to map out the system's configuration or identify other installed software, potentially aiding in more complex future attacks.
Technical details
A path traversal vulnerability (CWE-22) exists in /usr/local/www/snort/snort_ip_reputation.php within the Snort package for pfSense. The 'iplist' parameter is used in a file existence check without proper sanitization of directory traversal sequences (e.g., ../). While the application does not return the file contents, the boolean response indicating whether a file exists allows an authenticated attacker with 'WebCfg - Services: Snort package' permissions to perform local file enumeration. The issue was addressed by restricting file checks to the designated IP reputation directory.
Affected products
- Netgate pfSense CE up to (excluding) 2.8.0
- Netgate pfSense Plus 25.07, 25.07.1
- Netgate Snort package <= 4.1.6_25
Timeline
- 2025-09-09: advisory: Initial disclosure by VulnCheck
- 2025-09-09: patched: Fix committed to FreeBSD-ports repository