Summary
A stored cross-site scripting vulnerability in OPNsense allows a crafted OpenVPN client common name to inject script into administrator-facing connection-status pages. If an authenticated client can provision a backend username containing a double quote, the script may execute in an administrator's session when the affected dashboard or status view is opened.
A stored cross-site scripting vulnerability in OPNsense allows a crafted OpenVPN client common name to inject script into administrator-facing connection-status pages. If an authenticated client can provision a backend username containing a double quote, the script may execute in an administrator's session when the affected dashboard or status view is opened.
Affected context
The issue can occur in OPNsense deployments that use an OpenVPN server with username-as-common-name and RADIUS or LDAP authentication. It requires a trusted identity backend to accept a username containing a double quote and an administrator to view the OpenVPN client dashboard or connection-status page. Local usernames may be protected by stricter validation, so the exposure depends on the configured authentication and provisioning paths.
The issue can occur in OPNsense deployments that use an OpenVPN server with username-as-common-name and RADIUS or LDAP authentication. It requires a trusted identity backend to accept a username containing a double quote and an administrator to view the OpenVPN client dashboard or connection-status page. Local usernames may be protected by stricter validation, so the exposure depends on the configured authentication and provisioning paths.
Exploit preconditions
- Attack surface: Administrator-facing OpenVPN dashboard and connection-status views
- Required access: An authenticated OpenVPN client account, plus the ability to provision or self-register a backend username containing a double quote
- Trigger point: Rendering the client common name in a
data-common-nameHTML attribute, followed by the administrator opening the relevant page and triggering the injected event - Why exploitation is possible: The common name is inserted without quote-safe HTML encoding, allowing attacker-controlled input to terminate the attribute and introduce script-capable markup
- Attack surface: Administrator-facing OpenVPN dashboard and connection-status views
- Required access: An authenticated OpenVPN client account, plus the ability to provision or self-register a backend username containing a double quote
- Trigger point: Rendering the client common name in a
data-common-nameHTML attribute, followed by the administrator opening the relevant page and triggering the injected event - Why exploitation is possible: The common name is inserted without quote-safe HTML encoding, allowing attacker-controlled input to terminate the attribute and introduce script-capable markup
Why this happens
The underlying bug is context-inappropriate output encoding. An attacker- controlled OpenVPN client common name is placed into an HTML attribute without escaping characters that have structural meaning in that context. This permits attribute injection and event-handler execution, mapping to CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting).
The underlying bug is context-inappropriate output encoding. An attacker- controlled OpenVPN client common name is placed into an HTML attribute without escaping characters that have structural meaning in that context. This permits attribute injection and event-handler execution, mapping to CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting).
Potential impact
- An attacker may execute script in an administrator's browser session
- The script could read sensitive firewall configuration data
- An attacker could invoke privileged administrative APIs
- The root account password could be reset
- The vulnerability could lead to root-level command execution
- Firewall configuration, routing, or authentication settings could be altered
- An attacker may execute script in an administrator's browser session
- The script could read sensitive firewall configuration data
- An attacker could invoke privileged administrative APIs
- The root account password could be reset
- The vulnerability could lead to root-level command execution
- Firewall configuration, routing, or authentication settings could be altered
General mitigation guidance
Mitigation generally focuses on treating identity attributes as untrusted
display data and applying context-specific output encoding.
Common defensive patterns include:
- HTML-attribute-encode all externally sourced values before inserting them into markup
- Prefer DOM APIs that assign text or safely encoded attribute values rather than concatenating HTML
- Validate backend usernames against a conservative, documented character policy where operationally appropriate
- Apply server-side validation in addition to client-side checks
- Use a restrictive Content Security Policy to reduce the impact of injected event handlers
- Limit administrator session privileges and require reauthentication for sensitive operations
- Avoid exposing high-impact administrative APIs to ordinary browser contexts when possible
Mitigation generally focuses on treating identity attributes as untrusted
display data and applying context-specific output encoding.
Common defensive patterns include:
- HTML-attribute-encode all externally sourced values before inserting them into markup
- Prefer DOM APIs that assign text or safely encoded attribute values rather than concatenating HTML
- Validate backend usernames against a conservative, documented character policy where operationally appropriate
- Apply server-side validation in addition to client-side checks
- Use a restrictive Content Security Policy to reduce the impact of injected event handlers
- Limit administrator session privileges and require reauthentication for sensitive operations
- Avoid exposing high-impact administrative APIs to ordinary browser contexts when possible
How teams detect issues like this
Organizations can look for:
- Static-analysis findings involving string concatenation into HTML attributes
- Code-review signals such as unescaped identity, username, common-name, or directory attributes in templates and JavaScript
- Tests that render quotes, angle brackets, and event-handler characters in externally controlled display fields
- Dynamic application-security tests covering dashboard and status pages with provisioned directory identities
- Content Security Policy reports and browser telemetry indicating unexpected inline handlers or script execution
- Policy enforcement requiring context-aware output encoding and centralized rendering helpers
Automated code-review and SAST tools may help identify unsafe HTML construction, but findings should be validated against the actual browser output context.
Organizations can look for:
- Static-analysis findings involving string concatenation into HTML attributes
- Code-review signals such as unescaped identity, username, common-name, or directory attributes in templates and JavaScript
- Tests that render quotes, angle brackets, and event-handler characters in externally controlled display fields
- Dynamic application-security tests covering dashboard and status pages with provisioned directory identities
- Content Security Policy reports and browser telemetry indicating unexpected inline handlers or script execution
- Policy enforcement requiring context-aware output encoding and centralized rendering helpers
Automated code-review and SAST tools may help identify unsafe HTML construction, but findings should be validated against the actual browser output context.
