CVE-2019-25372: OPNsense XSS Vulnerability Disclosed

CVE-2019-25372 Overview

CVE-2019-25372 is a reflected cross-site scripting (XSS) vulnerability affecting OPNsense 19.1, a widely-deployed open-source firewall and routing platform. The vulnerability exists in the diagnostic traceroute functionality (diag_traceroute.php) where insufficient input validation of the host parameter allows unauthenticated attackers to inject malicious JavaScript code that executes within the context of an authenticated user's browser session.

This vulnerability enables attackers to craft malicious URLs containing JavaScript payloads that, when visited by an authenticated OPNsense administrator, can steal session cookies, perform administrative actions on behalf of the victim, or redirect users to attacker-controlled sites.

Critical Impact

Successful exploitation could allow attackers to hijack administrator sessions, modify firewall configurations, or exfiltrate sensitive network security settings from OPNsense installations.

Affected Products

• OPNsense 19.1

Discovery Timeline

• 2026-02-15 - CVE-2019-25372 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25372

Vulnerability Analysis

The vulnerability stems from a classic reflected XSS flaw in the diagnostic traceroute web interface of OPNsense 19.1. When users submit a traceroute request through the web GUI, the host parameter value is reflected back to the user without proper sanitization or encoding. This allows attackers to embed arbitrary JavaScript code within the parameter, which then executes in the victim's browser when the malicious page renders.

The attack surface is particularly concerning because the affected endpoint (diag_traceroute.php) is accessible to authenticated administrators who typically have elevated privileges within the firewall management interface. While the attack requires user interaction (clicking a malicious link), social engineering techniques can easily trick administrators into accessing crafted URLs.

Root Cause

The root cause of CVE-2019-25372 is improper input validation and output encoding in the diag_traceroute.php script. The application fails to sanitize user-supplied input in the host parameter before reflecting it back in the HTTP response. Specifically, special characters such as angle brackets (<, >), quotes, and other HTML/JavaScript metacharacters are not properly escaped, allowing attackers to break out of the expected context and inject executable script content.

Attack Vector

The attack is executed via network-based delivery, typically through a crafted URL sent to a victim administrator via phishing email, malicious website, or other social engineering techniques. The attacker constructs a POST request to diag_traceroute.php containing a malicious JavaScript payload in the host parameter.

When the victim clicks the link or submits the form, the malicious script executes within their authenticated browser session. The attacker can then leverage this execution context to steal session tokens, perform CSRF attacks against administrative functions, or redirect the user to attacker-controlled infrastructure.

The vulnerability mechanism involves crafted POST requests to the diag_traceroute.php endpoint where the host parameter contains JavaScript payloads. When the server processes these requests, it reflects the unsanitized input back to the browser, allowing script execution. For detailed exploitation examples, see the Exploit-DB #46351 entry.

Detection Methods for CVE-2019-25372

Indicators of Compromise

• HTTP requests to /diag_traceroute.php containing suspicious characters such as <script>, javascript:, onerror=, or similar XSS payload patterns in the host parameter
• Unusual administrative session activity following users accessing external links
• Browser console errors or unexpected script execution in administrator sessions
• Access logs showing POST requests to diagnostic pages with encoded or obfuscated payloads

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in requests to OPNsense administrative endpoints
• Implement Content Security Policy (CSP) headers to restrict inline script execution
• Monitor HTTP access logs for requests containing suspicious characters or encoded JavaScript in form parameters
• Use browser-based security extensions that detect and alert on reflected XSS attempts

Monitoring Recommendations

• Enable detailed logging for all administrative interface access attempts
• Configure SIEM alerts for requests containing XSS-related patterns targeting /diag_traceroute.php
• Audit administrator session activity for unusual behavior patterns following external link access
• Regularly review web server access logs for anomalous request patterns to diagnostic endpoints

How to Mitigate CVE-2019-25372

Immediate Actions Required

• Upgrade OPNsense to a version newer than 19.1 that includes the security fix for this vulnerability
• Restrict administrative interface access to trusted networks only via firewall rules
• Implement network segmentation to limit exposure of the OPNsense management interface
• Educate administrators about the risks of clicking untrusted links while logged into administrative interfaces

Patch Information

The recommended mitigation is to upgrade OPNsense to a patched version beyond 19.1. Administrators should consult the OPNsense Official Website for the latest stable release and follow their upgrade procedures. Additional details about this vulnerability can be found in the VulnCheck OPNsense Advisory and the OPNsense Forum Discussion.

Workarounds

• Restrict access to the OPNsense administrative interface to trusted IP addresses only using firewall rules
• Use a separate browser profile or incognito mode when accessing external links, avoiding authenticated OPNsense sessions
• Implement reverse proxy with XSS filtering capabilities in front of the OPNsense web interface
• Consider disabling the diagnostic traceroute feature if not required for operations

# Example: Restrict admin interface access to trusted network
# Add to OPNsense firewall rules (via GUI or config)
# Block external access to management interface on port 443
# Only allow connections from management VLAN (e.g., 10.0.100.0/24)
# Firewall -> Rules -> WAN -> Add rule to block TCP 443 from !10.0.100.0/24