pfSense » pfSense Packages

The configuration of the curl session used for submitting AutoConfigBackup blobs to the pfSense portal is explicitly set to not verify the authenticity of the server's certificate. This could allow for a Man in the Middle attacker to intercept requests from a pfSense installation and intercept encrypted configuration file uploads, and users' portal username/passwords, granting the attacker access to their portal account and anything in it.

The line of code in question is located here:

• https://github.com/pfsense/pfsense-packages/blob/675b121ee2de4c1c430219053a9ba5f0d6a7e568/config/autoconfigbackup/autoconfigbackup.inc#L257

Curl documentation for the option is here:

• http://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html

Remediation should be to change the CURLOPT_SSL_VERIFYPEER from 0 to 1, as follows:

--- autoconfigbackup.inc    2015-12-01 11:50:02.000000000 -0800
+++ autoconfigbackup.inc-patched    2015-12-01 11:50:26.000000000 -0800
@@ -141,3 +141,3 @@
     curl_setopt($curl_session, CURLOPT_HTTPHEADER, array("Authorization: Basic " . base64_encode("{$username}:{$password}")));
-    curl_setopt($curl_session, CURLOPT_SSL_VERIFYPEER, 0);
+    curl_setopt($curl_session, CURLOPT_SSL_VERIFYPEER, 1);
     curl_setopt($curl_session, CURLOPT_POST, 1);

Additional information on the vulnerability available here:

• https://cwe.mitre.org/data/definitions/295.html