CVE-2023-39007
📋 TL;DR
This vulnerability allows cross-site scripting (XSS) attacks in OPNsense firewall management interfaces. Attackers can inject malicious scripts via the cron job configuration interface, potentially compromising administrator sessions. Affects OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.
💻 Affected Systems
- OPNsense Community Edition
- OPNsense Business Edition
📦 What is this software?
Opnsense by Opnsense
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of firewall management, credential theft, lateral movement to internal networks, and installation of persistent backdoors.
Likely Case
Session hijacking of administrator accounts, unauthorized configuration changes, and potential data exfiltration from the management interface.
If Mitigated
Limited to session disruption or minor configuration tampering if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploit requires authenticated access to cron configuration interface. Public technical details available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition: 23.7+, Business Edition: 23.4.2+
Vendor Advisory: https://github.com/opnsense/core/commit/5edff49db1cd8b5078611e2f542d91c02af2b25c
Restart Required: No
Instructions:
1. Log into OPNsense web interface. 2. Navigate to System > Firmware > Updates. 3. Click 'Check for updates'. 4. Install available updates. 5. Confirm version is 23.7+ (Community) or 23.4.2+ (Business).
🔧 Temporary Workarounds
Disable Cron Component Access
allTemporarily restrict access to cron configuration interface
# Configure firewall rules to restrict access to management interface
# Use role-based access control to limit who can modify cron jobs
Input Validation Enhancement
linuxAdd custom input validation for cron job parameters
# Modify /usr/local/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
# Add proper sanitization for openAction parameter
🧯 If You Can't Patch
- Restrict management interface access to trusted IP addresses only using firewall rules.
- Implement web application firewall (WAF) with XSS protection rules.
🔍 How to Verify
Check if Vulnerable:
Check OPNsense version via web interface (System > Firmware > Status) or CLI: 'opnsense-version'Check Version:
opnsense-versionVerify Fix Applied:
Confirm version is 23.7+ (Community) or 23.4.2+ (Business). Check commit 5edff49db1cd8b5078611e2f542d91c02af2b25c is applied.📡 Detection & Monitoring
Log Indicators:
- Unusual cron configuration changes
- Multiple failed login attempts followed by cron access
- Suspicious JavaScript in cron job parameters
Network Indicators:
- Unexpected requests to /ui/cron/item/open with script tags
- Outbound connections from management interface to unknown destinations
SIEM Query:
source="opnsense" AND (uri="/ui/cron/item/open" AND (user_agent CONTAINS "script" OR referer CONTAINS "javascript:"))🔗 References
- https://github.com/opnsense/core/commit/5edff49db1cd8b5078611e2f542d91c02af2b25c
- https://github.com/opnsense/core/compare/23.1.11...23.7
- https://logicaltrust.net/blog/2023/08/opnsense.html
- https://github.com/opnsense/core/commit/5edff49db1cd8b5078611e2f542d91c02af2b25c
- https://github.com/opnsense/core/compare/23.1.11...23.7
- https://logicaltrust.net/blog/2023/08/opnsense.html
