Summary
A path traversal and arbitrary file write vulnerability in the OPNsense GeoIP alias importer allows a privileged user to influence where extracted archive content is stored. Under affected configurations, this may enable files to be written with root privileges and could lead to command execution and complete firewall compromise.
A path traversal and arbitrary file write vulnerability in the OPNsense GeoIP alias importer allows a privileged user to influence where extracted archive content is stored. Under affected configurations, this may enable files to be written with root privileges and could lead to command execution and complete firewall compromise.
Affected context
The issue occurs in OPNsense Firewall Alias GeoIP import processing when an administrator or other account with Firewall Alias Edit privilege can configure a user-controlled GeoIP source. Risk is present when archive metadata is used to construct output paths without validating country-code values, allowing writes to locations outside the intended GeoIP alias directory.
The issue occurs in OPNsense Firewall Alias GeoIP import processing when an administrator or other account with Firewall Alias Edit privilege can configure a user-controlled GeoIP source. Risk is present when archive metadata is used to construct output paths without validating country-code values, allowing writes to locations outside the intended GeoIP alias directory.
Exploit preconditions
- Attack surface: Firewall Alias GeoIP import functionality
- Required access: An account with Firewall Alias Edit privilege
- Attacker-controlled input: A configurable GeoIP source URL and archive contents
- Trigger point: Processing of ZIP or gzip-based GeoIP data
- Why exploitation is possible: An unvalidated country-code value influences output filenames, enabling path traversal and root-owned file writes
- Additional condition: A writable target must interact with a privileged system component, such as scheduled log-processing or command-execution functionality
- Attack surface: Firewall Alias GeoIP import functionality
- Required access: An account with Firewall Alias Edit privilege
- Attacker-controlled input: A configurable GeoIP source URL and archive contents
- Trigger point: Processing of ZIP or gzip-based GeoIP data
- Why exploitation is possible: An unvalidated country-code value influences output filenames, enabling path traversal and root-owned file writes
- Additional condition: A writable target must interact with a privileged system component, such as scheduled log-processing or command-execution functionality
Why this happens
The underlying bug is a failure to treat archive-derived metadata as untrusted path input. The importer uses a country-code value to construct filenames without adequately constraining the resulting path to the intended GeoIP alias directory. This maps primarily to CWE-22, Improper Limitation of a Pathname to a Restricted Directory. It also relates to CWE-73 because an external source controls the file destination, and CWE-78 where written content can later be interpreted by a command-execution mechanism.
The underlying bug is a failure to treat archive-derived metadata as untrusted path input. The importer uses a country-code value to construct filenames without adequately constraining the resulting path to the intended GeoIP alias directory. This maps primarily to CWE-22, Improper Limitation of a Pathname to a Restricted Directory. It also relates to CWE-73 because an external source controls the file destination, and CWE-78 where written content can later be interpreted by a command-execution mechanism.
Potential impact
- Attacker-controlled files may be written with root privileges
- Existing firewall or operating-system files may be overwritten
- Scheduled system processing may execute attacker-controlled commands
- The firewall configuration and protected network perimeter may be compromised
- Sensitive data may be exposed or altered
- Compromised systems may be used for lateral movement
- Attacker-controlled files may be written with root privileges
- Existing firewall or operating-system files may be overwritten
- Scheduled system processing may execute attacker-controlled commands
- The firewall configuration and protected network perimeter may be compromised
- Sensitive data may be exposed or altered
- Compromised systems may be used for lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing strict path and archive-boundary
controls before any privileged write occurs.
Common defensive patterns include:
- Treating archive filenames and metadata as untrusted input
- Allowing only canonical, expected country-code formats
- Resolving candidate paths and verifying they remain beneath a fixed destination directory
- Rejecting absolute paths, traversal components, symbolic-link escapes, and unexpected suffixes
- Using controlled temporary directories and non-privileged extraction stages
- Separating downloaded content from trusted system configuration and executable locations
- Restricting which accounts can configure external import sources
- Applying least privilege to import jobs and scheduled maintenance processes
- Validating generated files before they can be consumed by interpreters or command-execution services
Mitigation generally focuses on enforcing strict path and archive-boundary
controls before any privileged write occurs.
Common defensive patterns include:
- Treating archive filenames and metadata as untrusted input
- Allowing only canonical, expected country-code formats
- Resolving candidate paths and verifying they remain beneath a fixed destination directory
- Rejecting absolute paths, traversal components, symbolic-link escapes, and unexpected suffixes
- Using controlled temporary directories and non-privileged extraction stages
- Separating downloaded content from trusted system configuration and executable locations
- Restricting which accounts can configure external import sources
- Applying least privilege to import jobs and scheduled maintenance processes
- Validating generated files before they can be consumed by interpreters or command-execution services
How teams detect issues like this
Organizations can look for this vulnerability class through:
- Static analysis rules that flag path construction from archive metadata or external URLs
- Code review checks for missing canonicalization and destination-boundary validation
- Tests covering absolute paths, traversal sequences, symbolic links, unusual separators, and malformed metadata
- Monitoring for unexpected writes beneath system directories by firewall services
- File-integrity monitoring on configuration, logging, and scheduled-task locations
- Policy enforcement that restricts external import sources and privileged file creation
- Automated security review tools that identify archive extraction and command-injection data flows
Organizations can look for this vulnerability class through:
- Static analysis rules that flag path construction from archive metadata or external URLs
- Code review checks for missing canonicalization and destination-boundary validation
- Tests covering absolute paths, traversal sequences, symbolic links, unusual separators, and malformed metadata
- Monitoring for unexpected writes beneath system directories by firewall services
- File-integrity monitoring on configuration, logging, and scheduled-task locations
- Policy enforcement that restricts external import sources and privileged file creation
- Automated security review tools that identify archive extraction and command-injection data flows
