TL;DR
Deciso OPNsense's diag_backup.php script suffers from a command injection flaw leading to remote code execution with valid auth.
What happened
["A vulnerability in Deciso OPNsense's diag_backup.php allows for remote code execution via command injection.", 'Authentication is required to exploit this vulnerability.']
Why it matters for ops
['The affected function does not properly sanitize input, allowing attackers to inject commands.', 'Attackers with network proximity and valid credentials can execute arbitrary code on the system.']
Mitigation
- Update to the latest version of Deciso OPNsense which includes a fix for this vulnerability.
- Implement strict input validation and sanitization on all user inputs.
- Monitor network traffic for suspicious requests targeting /diag_backup.php
Action items
- Apply available security patches immediately.
- Review system logs for any signs of exploitation attempts.
- Increase monitoring of the affected component.
Detection IOCs
- HTTP requests targeting /diag_backup.php with unusual or malicious-looking parameters.
- Unusual command execution logs in OPNsense system logs.