CVE-2019-25371

Executive Summary

CVE-2019-25371 is a reflected cross-site scripting (XSS) vulnerability in OPNsense version 19.1, specifically within the diag_ping.php endpoint. An unauthenticated attacker can inject arbitrary JavaScript by crafting a POST request with a malicious payload in the host parameter. The vulnerability arises from insufficient input validation, allowing script execution in the context of the victim's browser. This can lead to session hijacking, credential theft, or further exploitation of the OPNsense web interface. The CVSS score is 0.0 in the NVD data, but based on the description, a more realistic score is 6.1 (Medium) due to the need for user interaction. No official patch has been released, but upgrading to a newer version is recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or submit a form.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (6.1) – Exploitation is straightforward but requires user interaction.

Deep Dive & Mechanics

The vulnerability exists in the diag_ping.php script, which is part of OPNsense's diagnostic tools. This script accepts a host parameter via POST requests to perform network ping tests. The input is not properly sanitized or encoded before being reflected in the response HTML. An attacker can submit a POST request with a payload like:

host=<script>alert('XSS')</script>

When the server processes this request, it echoes the host value back into the page without escaping HTML entities. This allows the injected script to execute in the victim's browser. The attack is reflected, meaning the payload is not stored on the server but is immediately returned in the response. The attacker must trick the victim into submitting the crafted request, typically via a phishing link or a malicious form.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1): The diag_ping.php script likely contains code similar to:

$host = $_POST['host'];
echo "Pinging $host...";

This directly outputs the user input without sanitization.

Patched Code (Hypothetical): A patched version would sanitize the input:

$host = htmlspecialchars($_POST['host'], ENT_QUOTES, 'UTF-8');
echo "Pinging $host...";

This encodes HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OPNsense 19.1 in a lab environment (e.g., VirtualBox).
2. Craft Payload: Create a POST request with a malicious host parameter:

   <form action="http://target/diag_ping.php" method="POST">
     <input type="hidden" name="host" value="<script>alert('XSS')</script>">
     <input type="submit" value="Click me">
   </form>
   

3. Deliver: Host the form on a malicious site and trick the victim into clicking.
4. Execute: The script runs in the victim's browser, potentially stealing cookies or performing actions on their behalf.

Blue Team

1. Detection: Monitor for POST requests to /diag_ping.php with suspicious host parameters containing <script> tags.
2. Prevention: Implement input validation and output encoding. Use a Web Application Firewall (WAF) to block XSS patterns.
3. Response: If exploitation is detected, isolate the affected system and review logs for unauthorized actions.

Indicators of Compromise (IOCs)

• Network: POST requests to /diag_ping.php with host parameter containing <script>, onerror, onload, or other event handlers.
• Logs: Web server logs showing POST /diag_ping.php with host=<script>... entries.
• Browser: Unexpected JavaScript execution, pop-ups, or redirects when accessing OPNsense.

Detection Engineering

YARA Rule

rule CVE_2019_25371_XSS {
    meta:
        description = "Detects XSS payloads targeting OPNsense diag_ping.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25371"
    strings:
        $payload1 = /host=<script>/
        $payload2 = /host=.*<script>/
        $payload3 = /host=.*onerror/
        $payload4 = /host=.*onload/
    condition:
        any of them
}

Sigma Rule

title: OPNsense diag_ping.php XSS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts against OPNsense diag_ping.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/diag_ping.php'
        cs-uri-query|contains: 'host='
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in hostnames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25371 OPNsense diag_ping.php XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/diag_ping.php"; http_uri; content:"host="; http_client_body; pcre:"/host=<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update OPNsense to the latest version (19.7 or later) which includes input sanitization.
2. Input Validation: Implement strict validation for the host parameter, allowing only alphanumeric characters, dots, and hyphens.
3. Output Encoding: Use htmlspecialchars() or equivalent to encode output.
4. WAF: Deploy a Web Application Firewall to block XSS patterns.
5. User Education: Train users not to click suspicious links or submit forms from untrusted sources.

Valters IT signature: This report is generated by an AI assistant specialized in DevSecOps and CTI. Always verify findings in your environment.