CVE-2019-25399 Overview
CVE-2019-25399 is a stored cross-site scripting (XSS) vulnerability in IPFire 2.21 Core Update 127. The flaw resides in the extrahd.cgi administrative script, which fails to properly sanitize the FS, PATH, and UUID parameters submitted via HTTP POST requests. An attacker who can submit crafted parameter values can inject JavaScript that executes in the browser of any authenticated administrator who later views the affected page. Successful exploitation allows session hijacking, unauthorized configuration changes, or pivoting deeper into the firewall management interface. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored JavaScript payloads execute in the context of authenticated IPFire administrator sessions, enabling attackers to manipulate firewall configuration and harvest credentials.
Affected Products
- IPFire 2.21 Core Update 127
- extrahd.cgi administrative CGI script
- IPFire web management interface
Discovery Timeline
- 2026-02-18 - CVE-2019-25399 published to NVD
- 2026-02-26 - Last updated in NVD database
Technical Details for CVE-2019-25399
Vulnerability Analysis
The vulnerability exists in the extrahd.cgi script, a component of the IPFire web administration console responsible for managing additional hard disks attached to the firewall appliance. The script accepts user-supplied input via three POST parameters: FS (file system type), PATH (mount path), and UUID (disk identifier). These values are stored and later rendered into HTML output without proper encoding or sanitization. An attacker who can reach the management interface and submit a request, or who can trick an administrator into submitting one, places a persistent JavaScript payload into the configuration data. Each time an administrator views the extra disks page, the payload executes within the trusted origin of the firewall console.
Root Cause
The root cause is missing output encoding in the Perl CGI template that renders the extra disks management page. User-controlled fields are interpolated directly into HTML without applying HTML entity escaping. Combined with the absence of a strict Content Security Policy on the IPFire web UI, any injected <script> tag or event handler attribute is interpreted by the administrator's browser as legitimate page content.
Attack Vector
Exploitation requires network access to the IPFire web interface and a low-privilege foothold sufficient to submit POST requests to extrahd.cgi, plus user interaction from an authenticated administrator who subsequently loads the affected page. An attacker crafts a POST request targeting extrahd.cgi with a JavaScript payload embedded in the FS, PATH, or UUID field. Once stored, the payload runs in the administrator's browser session, granting the attacker the ability to issue authenticated CSRF-style requests, read CSRF tokens, exfiltrate session cookies, or modify firewall rules. Public details for this issue are described in the VulnCheck Advisory for IPFire and the Exploit-DB entry #46344.
No verified proof-of-concept code is reproduced here. Refer to the linked advisories for the request structure and payload examples.
Detection Methods for CVE-2019-25399
Indicators of Compromise
- POST requests to /cgi-bin/extrahd.cgi containing <script>, onerror=, javascript:, or other HTML/JS markup within the FS, PATH, or UUID parameters.
- Unexpected entries in the IPFire extra hard disks configuration containing non-alphanumeric characters or HTML tags.
- Outbound HTTP requests from administrator workstations to attacker-controlled hosts immediately after loading the IPFire extra disks page.
Detection Strategies
- Inspect IPFire web server access logs (/var/log/httpd/access_log) for POST requests to extrahd.cgi and review the request bodies for suspicious markup.
- Deploy web application firewall rules that flag HTML or JavaScript metacharacters submitted to administrative CGI endpoints.
- Audit the on-disk configuration files written by extrahd.cgi for stored values that contain angle brackets, quotes, or script keywords.
Monitoring Recommendations
- Forward IPFire HTTPD logs to a centralized logging platform and alert on administrative POST requests originating from non-administrator source addresses.
- Monitor browser sessions of firewall administrators for anomalous DOM activity or unexpected outbound requests after authentication.
- Track changes to IPFire configuration files using file integrity monitoring to catch tampered extra disk entries.
How to Mitigate CVE-2019-25399
Immediate Actions Required
- Upgrade IPFire to a Core Update later than 127, where the extrahd.cgi input handling has been corrected.
- Restrict access to the IPFire web administration interface to a dedicated management VLAN or jump host using firewall rules.
- Review existing extra hard disk entries in the IPFire configuration and remove any that contain HTML or JavaScript artifacts.
Patch Information
No vendor security advisory URL is listed in the available CVE references. Administrators should upgrade to the latest IPFire 2.x Core Update available from the IPFire Official Website and review release notes for fixes to extrahd.cgi. The vulnerable build referenced in the CVE corresponds to the IPFire 2.21 Core 127 ISO.
Workarounds
- Limit administrator access to extrahd.cgi by enforcing source IP restrictions in the IPFire web server configuration.
- Require administrators to use dedicated, hardened browsers with script controls when managing IPFire, reducing the impact of injected JavaScript.
- Disable or remove unused extra hard disk functionality if the appliance does not require attached storage management.
# Configuration example: restrict web admin access by source IP using iptables
iptables -A INPUT -p tcp --dport 444 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 444 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
