Project

General

Profile

Actions
Copy link

Bug #16901

closed
JP JP

Daemon configuration manipulation via CR/LF in SNMP settings

Bug #16901: Daemon configuration manipulation via CR/LF in SNMP settings

Added by Jim Pingle 3 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
SNMP
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Multiple fields on services_snmp.php accept CR/LF characters and other characters which are not valid for their content, such as double quotes, which can allow a user to add arbitrary configuration directives.

Affected fields are, at a minimum: syslocation, syscontact, rocommunity, trapstring

This appears to be limited to configuration manipulation as bsnmpd does not have directives which execute external commands.

Files

16901.patch (4.88 KB) 16901.patch Jim Pingle, 06/19/2026 05:47 PM

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #1

  • File 16901.patch added
  • Status changed from New to Feedback
  • % Done changed from 0 to 100

Fixed in commit b1ff799da518f903901efc6ac574edebe6a9c525

Added validation for all SNMP GUI fields.

Patch is attached.

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #2

  • Status changed from Feedback to In Progress

As mentioned on #16909 the $ character is also special to bsnmpd. It is valid for variable substitution, but in the context of pfSense GUI options that doesn't make much sense to allow, so it should also be rejected.

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #3

  • File deleted (16901.patch)

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #4

Additional fix is in commit e664239552031b0a462be19011aa44608ffb360c

Updated patch attached.

GT Updated by Georgiy Tyutyunnik 2 months ago Actions
Copy link
 #5

latest 26.07 invalidates fields with special symbols
tested on
26.07-BETA (amd64)
built on Thu Jul 2 23:42:00 UTC 2026
FreeBSD 16.0-CURRENT

GT Updated by Georgiy Tyutyunnik 2 months ago Actions
Copy link
 #6

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #7

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom