Recent posts

#1

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by nero355 - Today at 06:01:33 PM

Calm down guys, Franco is already working on a patch :)

COOL! :)

#2

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by mimugmail - Today at 06:00:07 PM

Calm down guys, Franco is already working on a patch :)

[TIP :]

#3

26.7 Series / Re: Setup issues with new OPNS...

Last post by nero355 - Today at 05:57:53 PM

I thought after all these years I had plenty of knowledge until I attempted this installatoin of OPNSense Software on a PC.

TIP : Knowing a bit of FreeBSD helps a lot! :)

One other PC connected to network, setup as dhcp unable to connect to internet.

If you need this configured :

Static IP Im trying to use is 12.132.133.165, rest of info below.
WAN IP 12.132.133.160/29,
WAN Gateway 12.132.133.161,
WAN Subnet (CIDR)/29,
DNS 1 68.94.156.1,
DNS 2 68.94.157.1.

Then you probably need to assign the Default Gateway manually and things should start to work!

Even after reading instructions and reearching for weeks I cant get this to work.

Open a topic next time after a couple of days : We don't mind! ;)

I also dont understand the menu enough to figure out where some of this above metnioned info is supposed to go?

The DNS Servers are for OPNsense itself in the System Settings and the IP Addressing is simply for the WAN Interface.

I have never worked with additional IP Addresses in OPNsense but I am guessing those need to be Alias IP Interfaces assigned to the WAN Interface and Manually NAT-ted to from where you need them to be.
Hybrid NAT Mode or Fully Manual NAT Mode are the ones to use for this.

AI is useless as it just brings up old legacy menu tabs from many years ago.

As always... LOL! ^_^

I have had to reinstall 13 times.

DAMN... I feel your pain bro! ;(

#4

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by daern - Today at 05:44:22 PM

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger.

Yes, it is vulnerable, unlike what @meyergru would apparently like us to think. If you can reach any part of the web UI, you can reach php.

Add a firewall rule to only accept traffic to the management UI from the single PC you are currently sat at and sit tight for the update. You could even block all access and only manage the server via the console until such time as an update is available. Either way, there are mitigations available to you and a rushed, untested patch could probably end up resulting in the downtime that you are presumably trying to avoid.

No, it's not an ideal situation, but @meyergru is right in saying that if you think this is the only AI-driven exploit going around, you should probably open your eyes...

#5

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by some-random-user - Today at 05:15:24 PM

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger.

Yes, it is vulnerable, unlike what @meyergru would apparently like us to think. If you can reach any part of the web UI, you can reach php.

#6

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by ou1 - Today at 05:09:39 PM

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger. Or does that work without?

I would say yes, it is in danger, but luckily the attacker would need to be close to the AP to exploit it, it's not vulnerable to bots on the internet trying all public IPs.

#7

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by NickF - Today at 05:01:14 PM

Hi,

Given that this issue will need to be addressed in OPNsense at some point, is there a plan to incorporate the relevant upstream patches? If so, is there any rough timeline or release target for when that might happen?

If not, what is the process for getting that agreed?

Thanks
Nick

#8

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by jensk - Today at 04:56:27 PM

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger. Or does that work without?

[you]

#9

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by meyergru - Today at 04:40:34 PM

maybe you should refrain from exposing an administrative interface to the open

Why do you keep moving the goalposts? OPNsense is vulnerable in its default configuration.

Which goalposts, exactly? Patrick had already explained that the GUI is not accessible from WAN or newly added VLANs by default. I am referring to a security boundary that already exists.

For a direct attack against the GUI, an attacker first needs network access to it:

a. You have exposed the management interface to an untrusted network. That would be a configuration change you made, not the default configuration.
b. The attacker is on a LAN from which management access is permitted. If your threat model includes attacks from those LAN clients, restricting their access to the administrative interface is your responsibility.

The presence of a PHP vulnerability does not make the packet filter disappear. Assessing whether an attacker can actually reach the vulnerable service is fundamental to assessing exposure and urgency.

The bug needs fixing, I give you that. That does not make the existing security boundary irrelevant, and me pointing that out is not "moving the goalposts."

If anyone is moving the goalposts here, it is you: you are turning a discussion about actual exposure into a blanket demand for an emergency patch. The default configuration blocks direct WAN access. If your urgency instead stems from exposing the GUI to the Internet or to LAN clients you consider potential attackers, then that exposure results from your own failure to restrict administrative access appropriately.

#10

26.7 Series / Re: Critical PHP vuln: php2she...

Last post by Patrick M. Hausen - Today at 04:07:01 PM

FreeBSD has incorporated them in the HEAD and 2026Q4 ports branches.