pfSense

If pfSense software is configured to perform remote authentication via LDAP/RADIUS for the system itself, then the privilege check in xmlrpc.php can improperly test privileges in certain cases.

When xmlrpc.php attempts to check privileges it gathers account information via getUserEntry($username). This function returns an associative array that is missing the uid parameter if there is no matching local account. When checking privileges, a logic error causes this condition to not trigger the code that detects a lack of privileges to deny access.

This can allow a user with valid LDAP credentials, but no matching local account, to execute XMLRPC methods when they do not have the appropriate system-xmlrpc-ha-sync privilege. The available XMLRPC methods include exec_php which allows running arbitrary PHP code and by consequence, arbitrary shell commands.

POC script is attached that tests a variety of account types/privilege states. Read the comments and code for more info, but the accounts and infrastructure must already be setup for it to be of any use.