Cross-Site Scripting (XSS) Vulnerabilities in OPNsense Firewall

Executive Summary

This vulnerability involves multiple cross-site scripting (XSS) flaws in OPNsense firewall version 26.7.1_1 and earlier. It includes both Stored XSS and Reflected XSS vulnerabilities. Stored XSS allows injecting malicious JavaScript into the Description field under Interfaces → Assignments, which executes when viewed on pages like Dashboard or Interfaces → Overview. Reflected XSS occurs in the Firewall: Log Files: Live View section when JavaScript is injected into the search field and executed by pressing Apply.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in OPNsense, check for suspicious JavaScript code in the Description field under Interfaces → Assignments or in the Firewall Log Files Live View search field. Manually inspect these areas for injected scripts. No specific commands are provided in the resources.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges can execute JavaScript in the context of another user. This could lead to unauthorized actions, data theft, or session hijacking if a user visits a crafted page or clicks a malicious link. Both regular users and those with root privileges are affected.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OPNsense to a version later than 26.7.1_1 to address the XSS vulnerabilities. Monitor user inputs in the affected fields and sanitize any suspicious JavaScript code. Apply patches as soon as they are available from OPNsense.

Useful 0 Not Useful 0