CVE-2025-13698

Executive Summary

CVE-2025-13698 is a directory traversal vulnerability in Deciso OPNsense, specifically within the diag_backup.php script. This flaw allows an authenticated attacker with network-adjacent access to create arbitrary files on the target system by manipulating the filename parameter during a backup configuration operation. The vulnerability is rooted in insufficient validation of user-supplied paths before they are used in file operations. Successful exploitation could lead to the creation of files with root privileges, potentially enabling privilege escalation, persistence, or further compromise of the OPNsense firewall appliance.

The vulnerability has a CVSS v3.1 base score of 4.5 (Medium), with a vector of AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The attack vector is Adjacent Network, meaning the attacker must be on the same network segment as the target. Authentication is required, but the impact on integrity is high, as arbitrary files can be created. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core component of the OPNsense web interface. The risk is primarily to organizations using OPNsense as their firewall or router, where an attacker with network access and valid credentials could compromise the integrity of the system.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 4.5 (Medium)
• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same network segment (e.g., LAN, VPN).
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): Low (L) – Valid user credentials are needed.
• User Interaction (UI): None (N) – No user action required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file creation can overwrite critical system files.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ability to create files as root is a significant integrity risk. An attacker could plant malicious scripts, modify configuration files, or establish persistence. The requirement for authentication and adjacent network access reduces the immediate threat but does not eliminate it, especially in environments where multiple users have access to the OPNsense web GUI.

Deep Dive & Mechanics

The vulnerability resides in the diag_backup.php script, which is part of the OPNsense web interface used for creating and downloading backup configuration files. The script accepts a user-supplied filename parameter to specify the name of the backup file. Due to insufficient validation, an attacker can include directory traversal sequences (e.g., ../) in the filename parameter.

Mechanism:

1. The attacker authenticates to the OPNsense web GUI.
2. The attacker sends a crafted HTTP request to /diag_backup.php with a manipulated filename parameter, such as filename=../../etc/cron.d/malicious.
3. The script uses this path directly in file operations (e.g., fopen(), file_put_contents()) without sanitizing or canonicalizing the path.
4. The backup content (which can be controlled by the attacker through other means, such as modifying configuration data) is written to the specified location.
5. The file is created with root privileges, as the web server runs with elevated permissions.

Root Cause: The lack of proper validation of the user-supplied path before using it in file operations. The application should have used a whitelist of allowed filenames or sanitized the path to prevent directory traversal.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

<?php
// diag_backup.php - vulnerable version
$filename = $_GET['filename'];
$backup_data = generate_backup(); // function that creates backup content
file_put_contents("/var/backups/" . $filename, $backup_data);
?>

Patched Code (Conceptual PHP):

<?php
// diag_backup.php - patched version
$filename = basename($_GET['filename']); // Strip directory components
$allowed_extensions = ['xml', 'conf', 'txt'];
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_extensions)) {
    die("Invalid file extension.");
}
$backup_data = generate_backup();
file_put_contents("/var/backups/" . $filename, $backup_data);
?>

Explanation: The patched code uses basename() to remove any directory traversal components, ensuring only the filename is used. Additionally, it validates the file extension against a whitelist. The vulnerable code directly concatenates the user input into the path, allowing traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the OPNsense web interface (port 443 or 80).
• Valid user credentials (e.g., admin:opnsense).

Exploitation Steps:

1. Authenticate to the OPNsense web GUI.
2. Craft a request to create a file in a sensitive location, such as /etc/cron.d/ for persistence.
3. Use a tool like curl to send the malicious request.

Example curl command:

curl -k -X POST \
  -c cookies.txt -b cookies.txt \
  -d "filename=../../etc/cron.d/malicious&backup_data=* * * * * root /tmp/backdoor.sh" \
  "https://192.168.1.1/diag_backup.php"

Note: The exact parameter names and request format may vary. The attacker would need to analyze the actual HTTP request format of the backup functionality. The above is a conceptual example.

Alternative Approach: If the backup content is not directly controllable, the attacker could first modify a configuration setting (e.g., a firewall rule description) to contain malicious content, then trigger the backup to write that content to a target file.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual diag_backup.php requests with directory traversal patterns (e.g., ../).
• Alert on file creation events in sensitive directories (e.g., /etc/cron.d/, /usr/local/etc/, /root/).
• Use file integrity monitoring (FIM) to detect unauthorized file changes.

Defense:

• Apply the principle of least privilege to the web server process.
• Implement a Web Application Firewall (WAF) rule to block directory traversal attempts.
• Restrict access to the OPNsense web GUI to trusted IP addresses only.
• Enforce strong authentication and consider multi-factor authentication (MFA).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /diag_backup.php containing ../ or ..\\ in the filename parameter.
• Unusual POST requests to /diag_backup.php with large or unexpected data.

File System IOCs:

• Unexpected files in /etc/cron.d/, /usr/local/etc/, /root/, or other sensitive directories.
• Files with unusual names or permissions (e.g., world-readable scripts in /etc/).
• New files in /var/backups/ that do not match the expected naming convention.

Log IOCs:

• Web server access logs showing diag_backup.php requests with directory traversal patterns.
• System logs (e.g., /var/log/messages) indicating file creation events in protected directories.

Detection Engineering

YARA Rule

rule CVE_2025_13698_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in OPNsense diag_backup.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13698"
    strings:
        $traversal1 = "..\\" ascii wide
        $traversal2 = "../" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide
        $traversal4 = "%2e%2e\\" ascii wide
        $php_script = "diag_backup.php" ascii wide
    condition:
        $php_script and any of ($traversal*)
}

Sigma Rule

title: OPNsense diag_backup.php Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects directory traversal attempts in OPNsense diag_backup.php requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13698
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/diag_backup.php'
        cs-uri-query|contains: 
            - '..\\'
            - '../'
            - '%2e%2e%2f'
            - '%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate backup filenames containing dots (e.g., "backup.2025.04.10.xml")
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13698 OPNsense diag_backup.php Directory Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/diag_backup.php"; http_uri;
    content:"filename"; http_client_body;
    pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-13698;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the OPNsense web GUI to trusted IP addresses only. Use firewall rules to block access from untrusted networks.
2. Enforce Strong Authentication: Ensure all user accounts have strong passwords. Consider implementing multi-factor authentication (MFA) if supported.
3. Monitor Logs: Actively monitor web server and system logs for signs of exploitation.

Long-Term Fixes:

1. Apply Vendor Patch: Monitor Deciso's official channels for a security update. Once available, apply the patch immediately.
2. Implement WAF Rules: Deploy a Web Application Firewall (WAF) with rules to block directory traversal patterns.
3. Code Hardening: If you have access to the source code, apply the patched code logic (using basename() and extension whitelisting) to diag_backup.php.
4. File Integrity Monitoring: Deploy FIM tools to alert on unauthorized file creation in sensitive directories.

Workaround:

• If patching is not immediately possible, consider disabling the backup functionality temporarily by removing or renaming the diag_backup.php file (e.g., mv /usr/local/www/diag_backup.php /usr/local/www/diag_backup.php.disabled). This will break legitimate backup functionality but will mitigate the vulnerability.

Valters IT