Summary
A high-severity XPath injection vulnerability in the OPNsense Trust module allows privileged users to influence XPath expressions through attacker-controlled certificate and certificate-authority reference values. Under deployments where a user has CA Manager or Certificate Manager privileges, repeated object retrieval may reveal sensitive configuration data character by character.
A high-severity XPath injection vulnerability in the OPNsense Trust module allows privileged users to influence XPath expressions through attacker-controlled certificate and certificate-authority reference values. Under deployments where a user has CA Manager or Certificate Manager privileges, repeated object retrieval may reveal sensitive configuration data character by character.
Affected context
The vulnerability occurs in OPNsense Trust module workflows that process certificate authority or certificate reference identifiers and use them in XPath expressions. It is relevant when a user with CA Manager or Certificate Manager privileges can submit or influence these identifiers and trigger repeated retrieval operations against configuration data. Exposed information may include authentication material, private keys, VPN secrets, and high-availability credentials.
The vulnerability occurs in OPNsense Trust module workflows that process certificate authority or certificate reference identifiers and use them in XPath expressions. It is relevant when a user with CA Manager or Certificate Manager privileges can submit or influence these identifiers and trigger repeated retrieval operations against configuration data. Exposed information may include authentication material, private keys, VPN secrets, and high-availability credentials.
Exploit preconditions
- Attack surface: OPNsense Trust module certificate authority and certificate management functionality
- Required access: CA Manager or Certificate Manager privileges
- Trigger point: Retrieval or processing of objects whose reference identifiers are incorporated into XPath expressions
- Why exploitation is possible: Attacker-controlled values are interpreted as XPath syntax, allowing response behavior to act as a boolean oracle for configuration contents
- Attack surface: OPNsense Trust module certificate authority and certificate management functionality
- Required access: CA Manager or Certificate Manager privileges
- Trigger point: Retrieval or processing of objects whose reference identifiers are incorporated into XPath expressions
- Why exploitation is possible: Attacker-controlled values are interpreted as XPath syntax, allowing response behavior to act as a boolean oracle for configuration contents
Why this happens
The underlying issue is insufficient separation between untrusted reference values and XPath query syntax. Values stored or accepted by the Trust module are interpolated into XPath expressions without adequate structural validation or parameterized query handling. This maps primarily to CWE-643: Improper Neutralization of Data within XPath Expressions, with CWE-91: XML Injection describing the broader injection pattern.
The underlying issue is insufficient separation between untrusted reference values and XPath query syntax. Values stored or accepted by the Trust module are interpolated into XPath expressions without adequate structural validation or parameterized query handling. This maps primarily to CWE-643: Improper Neutralization of Data within XPath Expressions, with CWE-91: XML Injection describing the broader injection pattern.
Potential impact
- Sensitive configuration values may be disclosed character by character
- Password hashes and API credentials could be exposed
- Certificate private keys and VPN key material may be revealed
- High-availability credentials could be compromised
- Attackers may escalate privileges or compromise additional security domains
- Firewall, routing, and connected infrastructure trust relationships could be weakened
- Sensitive configuration values may be disclosed character by character
- Password hashes and API credentials could be exposed
- Certificate private keys and VPN key material may be revealed
- High-availability credentials could be compromised
- Attackers may escalate privileges or compromise additional security domains
- Firewall, routing, and connected infrastructure trust relationships could be weakened
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from becoming executable XPath syntax and reducing the sensitivity of readable configuration data.
Common defensive patterns include:
- Using parameterized or query-safe XML access mechanisms where supported
- Allowing only server-issued, canonical reference identifiers
- Applying strict allowlist validation for identifier format, length, and character set
- Separating object lookup from XPath expression construction
- Limiting CA Manager and Certificate Manager privileges according to least privilege
- Protecting configuration files and secrets with restrictive access controls
- Minimizing secret storage and exposure in shared configuration data
- Rotating credentials or keys when unauthorized disclosure is suspected
- Applying security fixes through the platform's supported maintenance process
Mitigation generally focuses on preventing untrusted values from becoming executable XPath syntax and reducing the sensitivity of readable configuration data.
Common defensive patterns include:
- Using parameterized or query-safe XML access mechanisms where supported
- Allowing only server-issued, canonical reference identifiers
- Applying strict allowlist validation for identifier format, length, and character set
- Separating object lookup from XPath expression construction
- Limiting CA Manager and Certificate Manager privileges according to least privilege
- Protecting configuration files and secrets with restrictive access controls
- Minimizing secret storage and exposure in shared configuration data
- Rotating credentials or keys when unauthorized disclosure is suspected
- Applying security fixes through the platform's supported maintenance process
How teams detect issues like this
Detection can combine static analysis, code review, and runtime monitoring:
- Search for string interpolation or concatenation involving XPath expressions and request-controlled values
- Review XML access code for missing allowlist validation or parameterization
- Flag certificate and CA reference fields that are accepted without canonical server-side resolution
- Monitor repeated retrieval requests that vary identifiers and produce subtly different responses
- Audit access to Trust module functions and correlate unusual activity with configuration reads
- Enforce secure coding policies that prohibit direct insertion of untrusted input into XPath queries
- Use automated code review or static analysis tools to identify XML and XPath injection patterns
Detection can combine static analysis, code review, and runtime monitoring:
- Search for string interpolation or concatenation involving XPath expressions and request-controlled values
- Review XML access code for missing allowlist validation or parameterization
- Flag certificate and CA reference fields that are accepted without canonical server-side resolution
- Monitor repeated retrieval requests that vary identifiers and produce subtly different responses
- Audit access to Trust module functions and correlate unusual activity with configuration reads
- Enforce secure coding policies that prohibit direct insertion of untrusted input into XPath queries
- Use automated code review or static analysis tools to identify XML and XPath injection patterns
