Advisory X41-2023-001: Two Vulnerabilities in OPNsense =========================================================== Highest Severity Rating: High Confirmed Affected Versions: 23.1.11_1, 23.7.3, 23.7.4 Confirmed Patched Versions: Commit 484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7 Vendor: Deciso B.V. / OPNsense Vendor URL: https://opnsense.org Credit: X41 D-Sec GmbH, Yasar Klawohn and JM Status: Public Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2023-001-opnsense Summary and Impact ------------------ The OPNsense dashboard displays widgets with information about the system, running services, gateways and more. These widgets can be arranged in different orders and columns. The values for the number of columns and the order of widgets are stored server-side and are the same for all users of an OPNsense instance. They are reflected unmodified on every visit. This can be abused by a low-privileged attacker to inject their own content into the page, enabling a cross-site scripting (XSS) attack that can result in privilege escalation. Product Description ------------------- OPNsense is an open source, FreeBSD-based firewall and routing operating system. It includes many features of commercial firewalls and can be managed entirely via its web GUI. Stored XSS in the OPNsense Dashboard via the column_count Parameter =================================================================== Severity Rating: High Vector: Network CWE: 79 CVSS Score: 8.0 CVSS Vector: 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Credit: X41 D-Sec GmbH, Yasar Klawohn Analysis -------- The number of columns displayed in the dashboard is set via an HTTP POST request to /index.php, using the column_count request parameter. This parameter is not properly escaped when returned to the client. To exploit this issue, the payload "><script>alert(1)</script> is submitted as part of the column_count parameter. This input is reflected unmodified in the response and on any subsequent visit to the dashboard by any user. Only the "Lobby: Login / Logout / Dashboard" permission is required to abuse this issue. Once the server receives the POST request, the column_count parameter is written unmodified into the configuration: } elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['origin']) && $_POST['origin'] == 'dashboard') { // ... if (!empty($_POST['column_count'])) { $config['widgets']['column_count'] = $_POST['column_count']; } elseif(isset($config['widgets']['column_count'])) { unset($config['widgets']['column_count']); } write_config('Widget configuration has been changed'); header(url_safe('Location: /index.php')); exit; } // from: // https://github.com/opnsense/core/blob/2306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L66-L79 If the column_count parameter is not empty, it is used unmodified: // ... if ($_SERVER['REQUEST_METHOD'] === 'GET') { $pconfig = $config['widgets']; // ... $pconfig['column_count'] = !empty($pconfig['column_count']) ? $pconfig['column_count'] : 2; // ... // from: // https://github.com/opnsense/core/blob/306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L42 Below, the unmodified value is written: <!-- ... --> <section class="page-content-main"> <form method="post" id="iform"> <input type="hidden" value="dashboard" name="origin" id="origin" /> <input type="hidden" value="" name="sequence" id="sequence" /> <input type="hidden" value="<?= $pconfig['column_count'];?>" name="column_count" id="column_count_input" /> </form> <!-- ... --> <!-- from: https://github.com/opnsense/core/blob/306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L332 --> Proof of Concept ---------------- Log in as root. On the left side, go to System -> Access -> Users, and add a new user. For "Effective Privileges", only select "Lobby: Login / Logout / Dashboard". The user is now only able to view the dashboard and the help pages. Log in as that newly created user and open your browser's network monitor. In the OPNsense dashboard, select "1 column" from the top right and then press "save settings". Repeat the POST request and replace the column_count variable with column_count=1"><script>alert(1)</script> Now, log in as admin again, you should see an alert box resulting from the following HTML response: <form method="post" id="iform"> <!-- .. --> <input type="hidden" value="1"> <script>alert(1)</script>" name="column_count" id="column_count_input" /> </form> This is the stored XSS and can result in privilege escalation. The OPNsense developers did apply a Content-Security-Policy, but unfortunately allow unsafe-inline and unsafe-eval for scripts, which does not prevent the exploitation of this vulnerability. Stored XSS in the OPNsense Dashboard via the sequence Parameter =============================================================== Severity Rating: High Vector: Network CWE: 79 CVSS Score: 8.0 CVSS Vector: 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Credit: X41 D-Sec GmbH, JM and Yasar Klawohn Analysis -------- The order in which the widgets are displayed in the Dashboard is set via an HTTP POST request to /index.php, using the sequence request parameter. This parameter is not properly escaped when returned to the client. To exploit this issue, the payload "><script>alert(1)</script> is submitted as part of the sequence parameter. This input is reflected unmodified in the response and on any subsequent visit to the dashboard by any user. Only the "Lobby: Login / Logout / Dashboard" permission is required to abuse this issue. The order in which widgets are displayed on the dashboard can be set in the same POST request, via the sequence parameter. The sequence parameter has the following format: sequence=services_status-container:00000000-col3:show, interface_list-container:00000001-col4:show, gateways-container:00000002-col4:show Once the server receives the POST request, the sequence parameter is written unmodified into the configuration: } elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['origin']) && $_POST['origin'] == 'dashboard') { if (!empty($_POST['sequence'])) { $config['widgets']['sequence'] = $_POST['sequence']; } elseif (isset($config['widgets']['sequence'])) { unset($config['widgets']['sequence']); } // ... write_config('Widget configuration has been changed'); header(url_safe('Location: /index.php')); exit; } // from: // https://github.com/opnsense/core/blob/cbaf7cee1f0a6fabd1ec4c752a5d169c402976dc/src/www/index.php#L66-L80 When serving a GET request, the sequence parameter is returned unmodified, starting with a read of its value from the configuration: // ... $pconfig = $config['widgets']; // set default dashboard view $pconfig['sequence'] = !empty($pconfig['sequence']) ? $pconfig['sequence'] : ''; // ... // from: // https://github.com/opnsense/core/blob/2306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L39-L41 sequence is then split by comma and further split by colon into name, sortKey, and state. The list of widgets is sorted on the server side using the sortKey. $widgetSeqParts = explode(",", $pconfig['sequence']); foreach (glob('/usr/local/www/widgets/widgets/*.widget.php') as $php_file) { $widgetItem = array(); // [...] foreach ($widgetSeqParts as $seqPart) { $tmp = explode(':', $seqPart); if (count($tmp) == 3 && explode('-', $tmp[0])[0] == $widgetItem['name'] ) { $widgetItem['state'] = $tmp[2]; $widgetItem['sortKey'] = $tmp[1]; } } $widgetCollection[] = $widgetItem; } // sort widgets usort($widgetCollection, function ($item1, $item2) { return strcmp(strtolower($item1['sortKey']), strtolower($item2['sortKey'])); }); // from: // https://github.com/opnsense/core/blob/2306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L44-L65 Finally, the sortKey is written unescaped into an HTML attribute: <section class="widgetdiv" data-sortkey="<?=$widgetItem['sortKey'] ?>" id="<?=$widgetItem['name'];?>" style="display:<?=$divdisplay;?>;" <!-- from: https://github.com/opnsense/core/blob/2306449329e462364c07317b23a1f257779a4fc8/src/www/index.php#L374 --> Proof of Concept ---------------- Log in as root. On the left side, go to System -> Access -> Users, and add a new user. For "Effective Privileges", only select "Lobby: Login / Logout / Dashboard". The user is now only able to view the dashboard and the help pages. Log in as that newly created user and open your browser's network monitor. In the OPNsense dashboard, reorder the widgets via drag-and-drop, then press "save settings". Repeat the POST request and replace the sequence variable with sequence=gateways-container:1"><script>alert(1)</script>-col4:show Now, log in as admin again, you should see an alert box resulting from the following HTML response: <div class="container-fluid"> <!-- ... --> <section class="widgetdiv" data-sortkey="1"> <script>alert(2)</script> -col4" id="gateways" style="display:block;"> This is the stored XSS and can result in privilege escalation. The OPNsense developers did apply a Content-Security-Policy, but unfortunately allow unsafe-inline and unsafe-eval for scripts, which does not prevent the exploitation of this vulnerability. Workarounds =========== Remove all effective privileges for /index.php* of low-privilege users. Timeline ======== 2023-09-13: Problem discovered 2023-09-14: Write-up and discovery of second finding 2023-09-19: Disclosure to Deciso B.V. / OPNsense 2023-09-19: Issue fixed upstream by Deciso B.V. / OPNsense 2023-09-20: CVE requested 2023-09-20: Informed Deciso B.V. / OPNsense that we will make the issues public the following day, since the patch is public 2023-09-21: Release of advisory About X41 D-Sec GmbH ==================== X41 is an expert provider for application security services. Having extensive industry experience and expertise in the area of information security, a strong core security team of world class security experts enables X41 to perform premium security services. Fields of expertise in the area of application security are security centered code reviews, binary reverse engineering and vulnerability discovery. Custom research and IT security consulting and support services are core competencies of X41.