pfSense: pfSense-SA-19_08.webgui: Privilege Escalation in the WebGUI

Description

When testing if a privilege matches a requested page, the path to the filename was not fully resolved before the check was performed. This allowed a directory traversal style attack to bypass privilege checks and gain elevated privileges. An authenticated user with access to a page in the WebGUI could have used a directory traversal style attack to access other pages for which they did not have access, gaining elevated privileges. For example, a user granted access to "a.php" could have gained access to "b.php" by submitting a request for "a.php/../b.php". The privilege system matched "a.php" but the WebGUI served "b.php" to the client. Note that most browsers and HTTP clients will not allow this type of URL, so attacks are limited to clients such as cURL (using --path-as-is) or special purpose proxies which allow these requests.