FKIE_CVE-2025-34312

Vulnerability from fkie_nvd - Published: 2025-10-28 15:16 - Updated: 2025-11-03 17:02
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.
References
disclosure@vulncheck.comhttps://bugzilla.ipfire.org/show_bug.cgi?id=13887Issue Tracking, Third Party Advisory
disclosure@vulncheck.comhttps://www.ipfire.org/blog/ipfire-2-29-core-update-198-releasedRelease Notes
disclosure@vulncheck.comhttps://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklistThird Party Advisory
Impacted products
Vendor Product Version
ipfire ipfire *
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
ipfire ipfire 2.29
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A0A85D3-A192-4FD9-9510-99D85BCF334A",
              "versionEndExcluding": "2.29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*",
              "matchCriteriaId": "A39350F9-D6D9-49A5-88BC-C5489AA6038C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*",
              "matchCriteriaId": "CDDC0CEB-073B-41A0-8A52-4DAAAD77AA6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*",
              "matchCriteriaId": "745640B9-2180-48C3-82CC-D6E73AAF95D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*",
              "matchCriteriaId": "08006D41-7288-4333-83FE-B6FD7CD5C779",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*",
              "matchCriteriaId": "15EE4FEE-62AB-4172-B898-19DE6F50B7AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*",
              "matchCriteriaId": "5B0ECE9B-DD45-40E1-842A-0B0B1786187E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*",
              "matchCriteriaId": "9B9BDB00-A750-4053-8812-5A3854042CB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*",
              "matchCriteriaId": "16F654D7-CC82-4428-BBEF-1110CAE75597",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*",
              "matchCriteriaId": "FFCC61A9-AF1B-4F8A-98D2-FB7854AF0EF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*",
              "matchCriteriaId": "7A66DC97-E88F-455E-B688-88BCC95E861B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*",
              "matchCriteriaId": "DDF56682-47E8-436F-B5FE-55A8B525D699",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*",
              "matchCriteriaId": "A4ADE9ED-675A-4577-AF4A-047B4D7D8E2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*",
              "matchCriteriaId": "3FA0F87A-3926-4B10-97C8-12EBFD9454D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*",
              "matchCriteriaId": "0E2F1488-B8FA-4BFF-81B9-308E0C462B47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*",
              "matchCriteriaId": "3480B74D-D516-4A8C-AAA3-C7990FEA345D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IPFire versions prior to 2.29 (Core Update 198) contain\u00a0a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the \u0027nobody\u0027 user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the \u0027nobody\u0027 user."
    }
  ],
  "id": "CVE-2025-34312",
  "lastModified": "2025-11-03T17:02:22.193",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-10-28T15:16:11.510",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.ipfire.org/show_bug.cgi?id=13887"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.