CVE-2019-25368: OPNsense 19.1 XSS Vulnerability

CVE-2019-25368 Overview

CVE-2019-25368 is a Cross-Site Scripting (XSS) vulnerability affecting OPNsense 19.1, an open-source firewall and routing platform. The vulnerability exists in the diag_backup.php endpoint, which fails to properly sanitize user-supplied input across multiple parameters. Attackers can exploit this flaw by injecting malicious JavaScript code through parameters including GDrive_GDriveEmail, GDrive_GDriveFolderID, GDrive_GDriveBackupCount, Nextcloud_url, Nextcloud_user, Nextcloud_password, Nextcloud_password_encryption, and Nextcloud_backupdir. When an authenticated administrator views the affected page, the injected script executes within their browser session context.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in authenticated administrator sessions, potentially leading to session hijacking, credential theft, or unauthorized configuration changes to firewall settings.

Affected Products

• OPNsense 19.1
• OPNsense diag_backup.php endpoint
• Cloud backup integration features (Google Drive and Nextcloud)

Discovery Timeline

• 2026-02-15 - CVE CVE-2019-25368 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25368

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The root of the issue lies in the diag_backup.php endpoint's failure to implement proper input validation and output encoding for multiple POST parameters related to cloud backup configuration.

The affected endpoint handles backup configuration for external storage services including Google Drive and Nextcloud. When users submit configuration data through POST requests, the application reflects these values back to the page without adequate sanitization. This creates an opportunity for attackers to craft malicious payloads that execute when rendered in an administrator's browser.

The vulnerability specifically affects parameters associated with cloud backup credentials and configuration settings. Since these features are typically configured by system administrators, successful exploitation directly targets privileged users with full access to firewall configuration.

Root Cause

The vulnerability stems from inadequate input validation and improper output encoding in the diag_backup.php file. The application fails to sanitize or encode special characters in user-supplied input before reflecting them back to the HTML response. Parameters such as GDrive_GDriveEmail, Nextcloud_url, and related fields accept arbitrary input that is then rendered without proper escaping, allowing script tags and JavaScript event handlers to execute in the browser context.

Attack Vector

The attack requires network access and targets authenticated administrator users. An attacker can craft a malicious POST request containing JavaScript payloads embedded within the vulnerable parameters. The attack can be delivered through various means:

1. Phishing attacks: Tricking an authenticated administrator into clicking a malicious link that submits a crafted form to the vulnerable endpoint
2. Cross-Site Request Forgery (CSRF): Combining this XSS vulnerability with CSRF to automatically submit malicious payloads when an administrator visits an attacker-controlled page
3. Social engineering: Convincing administrators to paste malicious configuration values

The vulnerability can be exploited by submitting POST requests with JavaScript payloads in parameters such as GDrive_GDriveEmail or Nextcloud_url. When the server processes these requests and returns the response page, the malicious scripts execute within the administrator's authenticated session. Technical details and proof-of-concept information can be found in the Exploit-DB entry #46351 and the VulnCheck OPNsense Advisory.

Detection Methods for CVE-2019-25368

Indicators of Compromise

• Unusual POST requests to /diag_backup.php containing script tags or JavaScript event handlers
• Web server access logs showing encoded JavaScript payloads in request parameters
• Administrator session activity from unexpected IP addresses or locations
• Unauthorized changes to backup configuration settings or firewall rules
• Browser console errors indicating blocked inline scripts (if CSP is enabled)

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in POST parameters targeting diag_backup.php
• Monitor HTTP logs for suspicious patterns including <script>, javascript:, onerror=, and similar XSS vectors in request bodies
• Configure intrusion detection systems to alert on attempts to inject HTML or JavaScript into cloud backup configuration parameters
• Review OPNsense audit logs for configuration changes made during suspicious time windows

Monitoring Recommendations

• Enable comprehensive access logging for the OPNsense web interface with full request body capture
• Implement real-time alerting for authentication events followed by backup configuration access
• Monitor for multiple failed or anomalous requests to backup-related endpoints
• Configure SIEM rules to correlate administrator session activity with unusual API calls or configuration changes

How to Mitigate CVE-2019-25368

Immediate Actions Required

• Upgrade OPNsense to a version newer than 19.1 that addresses this vulnerability
• Restrict administrative access to the OPNsense web interface to trusted networks only
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS attacks
• Enable two-factor authentication for all administrative accounts
• Review recent backup configuration changes for signs of tampering

Patch Information

Organizations running OPNsense 19.1 should upgrade to the latest stable release to remediate this vulnerability. OPNsense regularly publishes security updates through their official channels. Consult the Official OPNsense Website for current release information and upgrade documentation. Additional discussion regarding this issue can be found in the OPNsense Forum Discussion.

Workarounds

• Disable cloud backup integration features (Google Drive and Nextcloud) if not required until patching is complete
• Implement network segmentation to restrict access to the OPNsense administrative interface from untrusted networks
• Use a reverse proxy with WAF capabilities to filter malicious input before it reaches the OPNsense application
• Train administrators to recognize phishing attempts and avoid clicking suspicious links while authenticated to OPNsense

# Configuration example - Restrict admin interface access via firewall rules
# Add these rules to limit access to the OPNsense web interface

# Example: Allow admin access only from specific management subnet
# Navigate to Firewall > Rules > WAN and create a rule:
# Action: Block
# Interface: WAN
# Protocol: TCP
# Destination Port: 443 (HTTPS admin interface)
# Source: NOT management_subnet (e.g., NOT 10.0.1.0/24)

# Additionally, consider disabling cloud backup until patched:
# Navigate to System > Configuration > Backups
# Disable Google Drive and Nextcloud backup options