CVE-2019-25371
📋 TL;DR
CVE-2019-25371 is a reflected cross-site scripting vulnerability in OPNsense 19.1 that allows unauthenticated attackers to inject malicious JavaScript via the host parameter in diag_ping.php. This enables attackers to execute arbitrary scripts in users' browsers, potentially stealing session cookies or performing actions on behalf of authenticated users. All OPNsense 19.1 installations with the web interface exposed are affected.
💻 Affected Systems
- OPNsense
📦 What is this software?
Opnsense by Opnsense
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of the firewall, and pivot to internal networks.
Likely Case
Attackers steal user session cookies, perform actions as authenticated users, or redirect to phishing sites.
If Mitigated
With proper input validation and output encoding, no impact occurs as malicious scripts are neutralized.
🎯 Exploit Status
Exploit requires user interaction (clicking malicious link) but is trivial to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.1.1 and later
Vendor Advisory: https://forum.opnsense.org/index.php?topic=11469.0
Restart Required: No
Instructions:
1. Update OPNsense via System > Firmware > Updates. 2. Apply available patches. 3. Verify version is 19.1.1 or newer.
🔧 Temporary Workarounds
Input Validation Rule
allAdd input validation to block script tags in host parameter
Not applicable via command line; requires code modification
Web Application Firewall
allDeploy WAF to block XSS payloads in POST requests
Depends on WAF solution
🧯 If You Can't Patch
- Restrict access to OPNsense web interface to trusted IPs only
- Implement Content Security Policy headers to block inline scripts
🔍 How to Verify
Check if Vulnerable:
Test by submitting POST to /diag_ping.php with host parameter containing <script>alert('XSS')</script>Check Version:
opnsense-versionVerify Fix Applied:
After update, same test should show sanitized output without script execution📡 Detection & Monitoring
Log Indicators:
- POST requests to diag_ping.php with script tags in parameters
- Unusual JavaScript execution in web interface logs
Network Indicators:
- HTTP POST to diag_ping.php with encoded script payloads
SIEM Query:
http.method:POST AND http.uri:"/diag_ping.php" AND http.param.host:*script*