CVE-2019-25373: OPNsense 19.1 Stored XSS Vulnerability

CVE-2019-25373 Overview

CVE-2019-25373 is a stored cross-site scripting (XSS) vulnerability affecting OPNsense 19.1, an open-source firewall and routing platform. The vulnerability allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter within the firewall rules editor. Attackers can send POST requests to firewall_rules_edit.php with script payloads in the category field to execute arbitrary JavaScript in the browsers of other users accessing firewall rule pages.

This stored XSS vulnerability is particularly concerning in enterprise environments where multiple administrators may access the OPNsense web interface, potentially leading to session hijacking, credential theft, or administrative account compromise.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the context of other administrators' sessions, potentially leading to full administrative account takeover on OPNsense firewall appliances.

Affected Products

• OPNsense 19.1

Discovery Timeline

• 2026-02-15 - CVE-2019-25373 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25373

Vulnerability Analysis

This stored cross-site scripting vulnerability (CWE-79) exists in the firewall rules editing functionality of OPNsense 19.1. The web application fails to properly sanitize user-supplied input in the category parameter before storing it in the database and subsequently rendering it in the browser. When an authenticated user with firewall rule editing privileges submits a malicious script payload through the category field, this payload is stored persistently in the OPNsense configuration.

The stored nature of this XSS makes it particularly dangerous as the malicious script executes automatically whenever any user views the affected firewall rule page. The vulnerability requires an initial authenticated session to inject the payload but affects all subsequent viewers of the compromised page.

Root Cause

The root cause of CVE-2019-25373 is insufficient input validation and output encoding in the firewall_rules_edit.php script. The category parameter accepts arbitrary user input without proper sanitization, allowing script tags and JavaScript code to be stored in the system configuration. When the page is rendered, the stored payload is included directly in the HTML response without proper encoding, enabling script execution in the victim's browser context.

Attack Vector

The attack is conducted over the network and requires the attacker to have authenticated access to the OPNsense administrative interface. The attack flow involves:

1. An authenticated attacker navigates to the firewall rules editor at firewall_rules_edit.php
2. The attacker crafts a POST request containing a JavaScript payload in the category parameter
3. The malicious script is stored in the OPNsense configuration database
4. When another administrator views the firewall rules page, the stored payload executes in their browser
5. The attacker's script can then steal session tokens, perform actions on behalf of the victim, or redirect users to malicious sites

The vulnerability exploitation involves injecting script content through the category field in firewall rule edit requests. The payload is stored server-side and rendered without proper sanitization when administrators view the affected firewall rules page. Technical details and proof-of-concept information can be found in the Exploit-DB #46351 advisory.

Detection Methods for CVE-2019-25373

Indicators of Compromise

• Unusual or unexpected JavaScript content appearing in firewall rule category fields
• Firewall rule categories containing HTML tags, script elements, or event handlers like onerror, onclick, or onload
• Unexpected outbound connections from administrator workstations after accessing the OPNsense interface
• Session tokens or credentials being transmitted to external domains

Detection Strategies

• Monitor HTTP POST requests to firewall_rules_edit.php for suspicious payloads containing script tags or JavaScript event handlers
• Implement web application firewall (WAF) rules to detect XSS patterns in POST parameters targeting the OPNsense administrative interface
• Review OPNsense configuration files and database entries for stored script content in firewall rule metadata
• Analyze web server access logs for anomalous patterns indicating exploitation attempts

Monitoring Recommendations

• Enable detailed logging on the OPNsense web interface to capture all administrative actions
• Deploy browser-based XSS protection headers (Content-Security-Policy) to mitigate script execution impact
• Implement network monitoring to detect unusual JavaScript beacon traffic from administrative workstations
• Configure alerts for modifications to firewall rule categories that contain non-alphanumeric characters

How to Mitigate CVE-2019-25373

Immediate Actions Required

• Upgrade OPNsense to the latest available version that addresses this vulnerability
• Audit existing firewall rule configurations for any suspicious content in the category field
• Review access logs for evidence of exploitation or unauthorized modifications to firewall rules
• Restrict administrative access to the OPNsense interface to trusted networks only
• Implement Content-Security-Policy headers to reduce XSS impact

Patch Information

OPNsense users should upgrade to a version newer than 19.1 that includes patches for this stored XSS vulnerability. Consult the OPNsense Official Website and the OPNsense Forum Discussion for the latest security updates and upgrade guidance. Additional technical details are available in the VulnCheck OPNsense Advisory.

Workarounds

• Implement strict Content-Security-Policy headers that disable inline script execution
• Use a reverse proxy or WAF in front of the OPNsense administrative interface to filter malicious input
• Limit administrative access to the OPNsense web interface to a dedicated management VLAN
• Conduct regular audits of firewall rule configurations to identify any injected content
• Enable multi-factor authentication for administrative access to reduce the risk of compromised accounts being used for injection attacks

# Example CSP header configuration for nginx reverse proxy
# Add to server block protecting OPNsense admin interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;