pfBlockerNG log file download/clear lacks validation
The 'logfile' parameter in pfblockerng_log.php is not validated, and allows working on files outside of the expected location.
Due to this lack of validation, arbitrary files can be read or deleted.
#1 Updated by Jim Pingle about 1 year ago
- Status changed from New to Feedback
#3 Updated by Jordan Greene 2 months ago
- Status changed from Feedback to Resolved
pfBlockerNG-devel 2.2.5_37 on pfSense 2.4.5p1 only allows elements to be selected in the drop down and I did not appear to be able to change the entries via editing page source. Therefore only files listed could be downloaded/cleared which are contained to pfBlockerNG.