Stored XSS in OPNsense Firewall Rules via Filter API

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OPNsense before version 26.1.9. It allows authenticated attackers with firewall rule management privileges to inject malicious HTML or JavaScript code by entering it in the firewall rule description field. The unsanitized input is saved and later displayed on the Firewall Rules page, where it executes in the browsers of other authenticated users who view the page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OPNsense versions before 26.1.9 for stored XSS in firewall rule descriptions. Inspect the filter API endpoint for unsanitized input in rule descriptions. Review opnsense_bootgrid.js for raw innerHTML usage. Check browser console for unexpected scripts when viewing Firewall Rules page.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to hijack user sessions or steal credentials. Any authenticated user viewing the Firewall Rules page could have their browser compromised by the injected script, potentially leading to unauthorized access to the system or sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling session hijacking or credential theft. If exploited, attackers could gain unauthorized access to sensitive data, violating confidentiality requirements under these regulations. The stored XSS flaw allows malicious scripts to execute in authenticated user browsers, risking data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OPNsense to version 26.1.9 or later to address the stored XSS vulnerability in firewall rule descriptions. Review firewall rule descriptions for suspicious payloads and remove any unauthorized HTML or JavaScript content.

Useful 0 Not Useful 0