CVE-2025-34311
Description
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
18cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*range: <2.29
- cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*
- cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*
- (no CPE)range: <2.29 (Core Update 198)
- IPFire.org/IPFirev5Range: 0
Patches
Vulnerability mechanics
References
3- bugzilla.ipfire.org/show_bug.cginvdIssue TrackingThird Party Advisory
- www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creationnvdThird Party Advisory
- www.ipfire.org/blog/ipfire-2-29-core-update-198-releasednvdRelease Notes
News mentions
0No linked articles in our index yet.