CVE-2019-25376

Executive Summary

CVE-2019-25376 is a reflected cross-site scripting (XSS) vulnerability affecting OPNsense version 19.1. An unauthenticated attacker can inject arbitrary JavaScript into the ignoreLogACL parameter of the proxy endpoint. When a victim visits a crafted URL or submits a malicious POST request, the script executes in the context of the OPNsense web interface, potentially leading to session hijacking, credential theft, or further compromise of the firewall management interface. No official patch has been confirmed, and the vulnerability remains unpatched in the affected version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link or submit a form.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of authentication and the potential for session hijacking in a firewall management interface elevates the severity for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the proxy endpoint of OPNsense 19.1. The ignoreLogACL parameter is used to control logging of access control list (ACL) events. The application fails to sanitize or encode user-supplied input before reflecting it in the HTTP response. An attacker can craft a POST request to the proxy endpoint with malicious JavaScript embedded in the ignoreLogACL parameter. When the server processes the request, it reflects the unsanitized input back to the client, causing the browser to execute the injected script.

Attack Flow:

1. Attacker crafts a malicious URL or POST form containing JavaScript in the ignoreLogACL parameter.
2. Victim (authenticated OPNsense admin) clicks the link or submits the form.
3. The OPNsense server reflects the malicious input without sanitization.
4. The victim's browser executes the injected script in the context of the OPNsense web interface.
5. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of output encoding for the ignoreLogACL parameter in the proxy endpoint response.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1):

// Vulnerable: Direct reflection of user input
$ignoreLogACL = $_POST['ignoreLogACL'];
echo "<input type='hidden' name='ignoreLogACL' value='" . $ignoreLogACL . "'>";

Patched Code (Hypothetical Fix):

// Patched: HTML entity encoding
$ignoreLogACL = htmlspecialchars($_POST['ignoreLogACL'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='ignoreLogACL' value='" . $ignoreLogACL . "'>";

The fix uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

<html>
<body>
<form action="https://target.opnsense/proxy" method="POST">
  <input type="hidden" name="ignoreLogACL" value="<script>alert('XSS')</script>">
  <input type="submit" value="Click to exploit">
</form>
</body>
</html>

Lab Setup:

1. Deploy OPNsense 19.1 in a virtual machine (e.g., using VirtualBox or VMware).
2. Ensure the web interface is accessible on the network.
3. Host the PoC HTML file on a local web server (e.g., using Python: python3 -m http.server 8080).
4. As the victim, access the PoC page and click the submit button.
5. Observe the JavaScript execution (e.g., an alert box).

Advanced Payload:

<script>
fetch('/api/core/firmware/update', {method: 'POST'});
</script>

This payload attempts to trigger a firmware update without user consent.

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests to /proxy with suspicious ignoreLogACL parameters containing <script> tags or JavaScript code.
2. Use network intrusion detection systems (NIDS) to alert on patterns like ignoreLogACL=.*<script.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Conduct regular vulnerability scans to identify unpatched OPNsense instances.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /proxy with ignoreLogACL parameter containing <script> tags.
  • Outbound connections from OPNsense to attacker-controlled domains (if payload exfiltrates data).
• Host IOCs:
  • Unexpected JavaScript execution in the OPNsense web interface.
  • Unauthorized configuration changes or firmware updates.
• Log IOCs:
  • Web server logs showing ignoreLogACL=<script>...</script> entries.

Detection Engineering

YARA Rule

rule CVE_2019_25376_OPNsense_XSS {
    meta:
        description = "Detects reflected XSS attempts against OPNsense 19.1 ignoreLogACL parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25376"
    strings:
        $xss_pattern = /ignoreLogACL=.*<script/i
    condition:
        $xss_pattern
}

Sigma Rule

title: OPNsense Reflected XSS via ignoreLogACL
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to OPNsense proxy endpoint with malicious ignoreLogACL parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/proxy'
        cs-uri-query|contains: 'ignoreLogACL='
        cs-uri-query|re: 'ignoreLogACL=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in testing environments
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25376 OPNsense Reflected XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/proxy"; http_uri; content:"ignoreLogACL="; http_client_body; pcre:"/ignoreLogACL=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense: If a patched version is available (e.g., 19.1.x or later), upgrade immediately. Check the official OPNsense website for updates.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> in the ignoreLogACL parameter.
3. Input Validation: Implement server-side validation to reject any input containing HTML or JavaScript tags.
4. Output Encoding: Ensure all user-supplied data is HTML-entity encoded before reflection.

Long-Term Measures:

• Enforce Content Security Policy (CSP) headers to restrict script sources.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other OPNsense endpoints.

Workaround (if patching is not possible):

• Restrict access to the OPNsense web interface to trusted IP addresses only.
• Disable the proxy endpoint if not required.

Valters IT