CVE-2019-25376: OPNsense 19.1 XSS Vulnerability

CVE-2019-25376 Overview

CVE-2019-25376 is a reflected cross-site scripting (XSS) vulnerability affecting OPNsense 19.1, an open-source firewall and routing platform. This vulnerability allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can exploit this flaw by sending POST requests to the proxy endpoint with JavaScript code embedded in the ignoreLogACL parameter, resulting in arbitrary script execution within victims' browsers.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in the context of authenticated OPNsense administrator sessions, potentially leading to session hijacking, credential theft, or unauthorized configuration changes on the firewall.

Affected Products

• OPNsense 19.1

Discovery Timeline

• 2026-02-15 - CVE-2019-25376 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25376

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) exists in the proxy endpoint of OPNsense 19.1. The application fails to properly sanitize user-supplied input in the ignoreLogACL parameter before rendering it in the HTTP response. When a victim clicks a malicious link or submits a crafted form, the injected JavaScript executes in their browser session with the same privileges as the authenticated user.

The vulnerability is particularly concerning in the context of a firewall administration interface, where successful exploitation could grant attackers the ability to modify firewall rules, extract sensitive configuration data, or pivot to other network segments. Since OPNsense administrators typically have elevated network privileges, session compromise could have significant security implications.

Root Cause

The root cause of CVE-2019-25376 is improper input validation and output encoding in the OPNsense proxy endpoint. The ignoreLogACL parameter accepts user input that is directly reflected in the HTTP response without adequate sanitization or HTML entity encoding. This allows script tags and JavaScript event handlers to be executed by the victim's browser rather than being treated as harmless text.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL or form containing JavaScript payload in the ignoreLogACL parameter and tricks an authenticated OPNsense administrator into clicking the link or submitting the form. The malicious script then executes in the context of the victim's authenticated session.

The exploitation technique involves sending POST requests to the proxy endpoint with malicious JavaScript embedded in the ignoreLogACL parameter. When the server reflects this unsanitized input back to the browser, the script executes with the privileges of the logged-in user. Detailed technical information can be found in the Exploit-DB #46351 entry and the VulnCheck OPNsense Advisory.

Detection Methods for CVE-2019-25376

Indicators of Compromise

• Unusual POST requests to the OPNsense proxy endpoint containing script tags or JavaScript event handlers in the ignoreLogACL parameter
• Web server logs showing URL-encoded JavaScript payloads such as %3Cscript%3E or event handlers like onerror=, onload= in request parameters
• Multiple failed or suspicious login attempts following successful administrator sessions
• Unexpected configuration changes to firewall rules or proxy settings

Detection Strategies

• Configure web application firewalls (WAF) to detect and block common XSS payloads in HTTP parameters
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Review OPNsense access logs for requests containing suspicious characters or encoding patterns in the ignoreLogACL parameter
• Deploy endpoint detection and response (EDR) solutions to identify browser-based attacks targeting administrator workstations

Monitoring Recommendations

• Enable detailed logging on the OPNsense web interface to capture all POST requests to the proxy endpoint
• Monitor for session anomalies such as multiple concurrent sessions from different IP addresses for the same user
• Set up alerts for configuration changes made outside normal maintenance windows
• Correlate web server logs with authentication events to identify potential session hijacking attempts

How to Mitigate CVE-2019-25376

Immediate Actions Required

• Upgrade OPNsense to the latest stable release that addresses this vulnerability
• Restrict administrative interface access to trusted IP addresses or VPN connections only
• Implement browser-based XSS protection and ensure administrators use modern browsers with built-in XSS filtering
• Review recent configuration changes and access logs for signs of compromise

Patch Information

Organizations running OPNsense 19.1 should immediately upgrade to a patched version. Consult the OPNsense Official Website for the latest security updates and upgrade instructions. Additional context may be found in the OPNsense Forum Discussion.

Workarounds

• Restrict access to the OPNsense administrative interface to internal networks only or via VPN
• Implement a reverse proxy with XSS filtering capabilities in front of the OPNsense web interface
• Deploy Content Security Policy headers to limit script execution sources
• Train administrators to avoid clicking untrusted links while logged into the OPNsense console

# Example: Restrict administrative access to specific IP addresses via firewall rule
# Add this rule to limit web GUI access to trusted management IPs only
pfctl -t admin_allowed -T add 192.168.1.0/24
# Configure OPNsense to only accept connections from the admin_allowed table