Vulnerability in opnsense core

[ Description ]Official description

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• abraxaslabs.tech/research/opnsense-lockout-factory-ip
• github.com/opnsense/core
• github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/Authent…
• github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler
• github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68
• github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410
• github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv
• www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui…