IPFire vulnerabilities

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. Parameters such as DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are interpolated directly into the shell invocation without sanitization.

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. The values are stored and later rendered in the web interface without proper sanitation or encoding.

IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the txt_mailuser and txt_mailpass parameters when updating mail server settings. Values are stored and rendered without proper encoding.

IPFire versions prior to 2.29 (Core Update 198) contain a stored XSS vulnerability allowing an authenticated attacker to inject arbitrary JavaScript via the REMOTELOG_ADDR parameter when updating the remote syslog server address. The value is stored and rendered without proper encoding.

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability. An authenticated attacker can execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist, as the value is interpolated into a shell invocation without proper sanitation.