CVE-2019-25374: OPNsense Reflected XSS Vulnerability

CVE-2019-25374 Overview

CVE-2019-25374 is a reflected cross-site scripting (XSS) vulnerability in OPNsense 19.1. The flaw exists in vpn_ipsec_settings.php, where the passthrough_networks parameter is rendered back to users without proper sanitization. Attackers can craft POST requests containing JavaScript payloads that execute in the browser context of an authenticated administrator. Successful exploitation enables session theft, configuration tampering, and unauthorized actions on the firewall web interface. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An attacker who tricks an authenticated OPNsense administrator into submitting a crafted request can execute arbitrary JavaScript in the admin session and pivot to firewall configuration changes.

Affected Products

OPNsense 19.1
IPsec VPN configuration component (vpn_ipsec_settings.php)
Web administration interface

Discovery Timeline

2026-02-15 - CVE-2019-25374 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25374

Vulnerability Analysis

The vulnerability resides in the IPsec settings page of the OPNsense web administration interface. The passthrough_networks POST parameter accepts user-supplied input that is reflected back into the rendered HTML response without contextual output encoding. As a reflected XSS issue, the payload is not stored on the server but is delivered via a victim-initiated request, typically through a phishing link or attacker-controlled page. Because OPNsense administrators operate with full firewall privileges, script execution in that session can be used to alter VPN settings, exfiltrate session cookies, or invoke administrative endpoints.

Root Cause

The root cause is missing output encoding and input validation on the passthrough_networks field handled by vpn_ipsec_settings.php. User input flows directly into the HTML response, allowing breakout from the intended input context into executable script content. This is a classic [CWE-79] failure to neutralize HTML-significant characters before rendering.

Attack Vector

Exploitation requires user interaction. An attacker hosts a malicious page that auto-submits a POST request to the OPNsense IPsec settings endpoint with a JavaScript payload in passthrough_networks. When an authenticated administrator visits the page, the browser submits the request and the server reflects the payload, triggering script execution. Technical reproduction details are documented in Exploit-DB #46351 and the VulnCheck OPNsense Advisory.

Detection Methods for CVE-2019-25374

Indicators of Compromise

POST requests to /vpn_ipsec_settings.php containing <script>, onerror=, javascript:, or encoded equivalents in the passthrough_networks parameter
HTTP Referer headers pointing to external or untrusted origins on requests targeting OPNsense admin endpoints
Unexpected administrator session activity or configuration changes to IPsec VPN settings

Detection Strategies

Inspect web server and reverse proxy logs for passthrough_networks values containing HTML or JavaScript metacharacters such as <, >, ", or %3C
Deploy a web application firewall (WAF) rule set with XSS signatures in front of the OPNsense management interface
Correlate administrator login events with subsequent IPsec configuration changes to identify suspicious session reuse

Monitoring Recommendations

Forward OPNsense nginx and PHP-FPM access logs to a centralized SIEM for retention and pattern matching
Alert on cross-origin POST submissions to firewall management URLs from unexpected referrers
Track administrative configuration export and IPsec parameter modifications outside of change windows

How to Mitigate CVE-2019-25374

Immediate Actions Required

Upgrade OPNsense to the latest supported release; version 19.1 is end-of-life and must not remain in production
Restrict access to the OPNsense web administration interface to a dedicated management network or VPN
Require administrators to use a separate browser profile when managing the firewall to limit cross-site request exposure

Patch Information

OPNsense addressed reflected XSS issues in releases following 19.1. Operators should move to a current supported branch and confirm the fix by reviewing release notes on the OPNsense Official Website. Community discussion of the original report is available in the OPNsense Forum thread.

Workarounds

Block external access to vpn_ipsec_settings.php at the perimeter and permit only trusted management IPs
Enforce strict Content-Security-Policy and X-XSS-Protection headers on the management interface via a reverse proxy
Train administrators to avoid clicking untrusted links while authenticated to the firewall and to log out after configuration sessions

bash

# Example nginx reverse proxy hardening for the OPNsense admin interface
location /vpn_ipsec_settings.php {
    allow 10.0.0.0/24;        # management subnet
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass https://opnsense.internal;
}