OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration.
This issue is fixed in version 26.1.11.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb
security-advisories@github.com
https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674
security-advisories@github.com
https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j
security-advisories@github.com
https://hackerask.com/posts/opnsense
security-advisories@github.com