CVE-2019-25399: IPFire Stored XSS Vulnerability

CVE-2019-25399 Overview

CVE-2019-25399 is a stored cross-site scripting (XSS) vulnerability affecting IPFire 2.21 Core Update 127. The vulnerability exists in the extrahd.cgi script, which fails to properly sanitize user-supplied input in the FS, PATH, and UUID parameters. Attackers can exploit this flaw by submitting POST requests containing malicious JavaScript payloads, which are then stored and executed within the context of authenticated administrator sessions when the affected page is viewed.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in administrator sessions, potentially leading to session hijacking, privilege escalation, or unauthorized configuration changes on the firewall appliance.

Affected Products

• IPFire 2.21 Core Update 127
• IPFire firewall appliances running vulnerable extrahd.cgi script

Discovery Timeline

• 2026-02-18 - CVE CVE-2019-25399 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2019-25399

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in the extrahd.cgi script, which is part of the IPFire web-based administration interface. The script processes user input from multiple parameters—FS, PATH, and UUID—without implementing adequate input validation or output encoding. When an attacker submits a crafted POST request containing JavaScript payloads in these parameters, the malicious content is stored server-side.

Subsequently, when an authenticated administrator accesses the affected management page, the stored script payload executes within their browser session. This allows attackers to perform actions on behalf of the administrator, steal session cookies, or manipulate firewall configurations.

Root Cause

The root cause is improper input validation and missing output encoding in the extrahd.cgi script. The script accepts user-supplied values for the FS, PATH, and UUID parameters and stores them without sanitizing HTML entities or JavaScript content. When these values are rendered in the administrative interface, they are output directly into the HTML response without proper encoding, allowing embedded scripts to execute.

Attack Vector

The attack is network-based and requires low privileges to execute. An attacker with basic access to the IPFire administration interface can submit a POST request to extrahd.cgi containing malicious JavaScript in one or more of the vulnerable parameters (FS, PATH, or UUID). The payload is stored persistently, and any administrator who subsequently views the affected page will have the malicious script execute in their browser context.

The vulnerability allows an attacker to inject script tags or JavaScript event handlers that can steal session tokens, redirect administrators to phishing pages, or perform unauthorized administrative actions on the firewall. Technical details and a proof-of-concept are available in the Exploit-DB #46344 entry.

Detection Methods for CVE-2019-25399

Indicators of Compromise

• Unusual POST requests to /cgi-bin/extrahd.cgi containing script tags or JavaScript event handlers in FS, PATH, or UUID parameters
• Stored entries in IPFire configuration files containing encoded or obfuscated JavaScript content
• Administrator session anomalies such as unexpected cookie access or session token exfiltration attempts
• Web server logs showing requests with URL-encoded script payloads targeting the extrahd.cgi endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to CGI scripts
• Monitor IPFire access logs for suspicious patterns including <script> tags, javascript: URIs, or event handler injections
• Deploy SentinelOne endpoint protection to detect browser-based exploitation attempts and anomalous script execution
• Review stored configuration data for unexpected HTML or JavaScript content in device path-related fields

Monitoring Recommendations

• Enable verbose logging for IPFire CGI script access and review logs regularly for injection attempts
• Set up alerting for POST requests to extrahd.cgi containing common XSS patterns such as <script>, onerror=, or onload=
• Monitor administrator session activity for signs of session hijacking or unauthorized configuration changes

How to Mitigate CVE-2019-25399

Immediate Actions Required

• Upgrade IPFire to the latest available version that addresses this vulnerability
• Restrict administrative interface access to trusted networks only using firewall rules
• Review stored configuration data in extrahd.cgi related fields for any malicious content and remove suspicious entries
• Implement additional network segmentation to limit access to the IPFire management interface

Patch Information

Users should upgrade to a patched version of IPFire that addresses the stored XSS vulnerabilities in extrahd.cgi. Refer to the IPFire Official Website for the latest security updates and release notes. Additional advisory details are available from the VulnCheck Advisory on IPFire.

Workarounds

• Restrict access to the IPFire web management interface by limiting it to specific trusted IP addresses
• Place the administrative interface behind an additional authentication layer such as a VPN
• Disable the extrahd.cgi script if the functionality is not required in your environment
• Implement Content Security Policy (CSP) headers at the web server level to mitigate script execution

# Example: Restrict IPFire admin interface access to trusted networks
# Add to /etc/sysconfig/firewall.local or equivalent configuration
iptables -A INPUT -p tcp --dport 444 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 444 -j DROP