CVE-2019-25375
📋 TL;DR
CVE-2019-25375 is a reflected cross-site scripting vulnerability in OPNsense 19.1 that allows unauthenticated attackers to inject malicious JavaScript via the mailserver parameter in POST requests to the monit interface. This enables arbitrary code execution in users' browsers when they visit crafted URLs. All OPNsense 19.1 users with the monit interface accessible are affected.
💻 Affected Systems
- OPNsense
📦 What is this software?
Opnsense by Opnsense
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware via browser exploitation.
Likely Case
Session hijacking leading to unauthorized access to the firewall administration interface, potentially allowing further network compromise.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific user session that clicks the malicious link.
🎯 Exploit Status
Exploit requires user interaction (clicking malicious link) but is trivial to craft. Public exploit code available at Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.1.7 and later
Vendor Advisory: https://forum.opnsense.org/index.php?topic=11469.0
Restart Required: No
Instructions:
1. Update OPNsense via System → Firmware → Updates. 2. Click 'Check for updates'. 3. Install all available updates. 4. Reboot is recommended but not strictly required.
🔧 Temporary Workarounds
Restrict monit interface access
allBlock external access to monit interface using firewall rules
Add firewall rule to block port 2812 (default monit port) from untrusted networks
Disable monit service
linuxTemporarily disable monit monitoring service if not required
ssh into OPNsense and run: service monit stop
To disable permanently: echo 'monit_enable="NO"' >> /etc/rc.conf.local
🧯 If You Can't Patch
- Implement strict firewall rules to restrict monit interface access to trusted IP addresses only
- Deploy web application firewall (WAF) rules to filter XSS payloads in POST parameters
🔍 How to Verify
Check if Vulnerable:
Check OPNsense version via web interface: System → Firmware → Status, or run: opnsense-versionCheck Version:
opnsense-versionVerify Fix Applied:
Verify version is 19.1.7 or later. Test by attempting to inject basic XSS payload into mailserver parameter (in controlled environment).📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /monit/ with JavaScript in parameters
- Multiple failed login attempts after monit interface access
Network Indicators:
- HTTP requests containing <script> tags or JavaScript functions in POST data to port 2812
SIEM Query:
source="opnsense.log" AND ("mailserver" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload="))