Horizon Alert
Summary of the vulnerability and why it matters
This advisory highlights a critical vulnerability in OPNsense firewall and routing platforms, allowing an authenticated user to execute commands as root. The issue stems from unvalidated input used in constructing filenames, which can lead to code execution and a complete system compromise. This could affect the integrity and availability of network perimeter security.
- Unvalidated input allows root command execution.
- Critical systems, like firewalls, are targeted.
- Confirm relevance and exposure of OPNsense systems.
Attack Path
How an attacker could exploit the issue
An attacker with the ability to edit firewall aliases can trick OPNsense into writing arbitrary files to the system. By providing a specially crafted archive, the attacker can manipulate the GeoIP importer to create files in unintended locations. This, combined with a crafted newsyslog fragment and an oversized log file, allows the attacker to leverage a default cron job to execute commands with root privileges, leading to a full compromise of the firewall.
- Requires authenticated user with alias edit privilege.
- Unvalidated country code in archive filename.
- Complete firewall compromise via root cron job.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker with Firewall Alias Edit privilege could potentially write attacker-controlled content to the firewall system. This content could then be executed by a privileged cron job, potentially leading to a complete compromise of the firewall.
- Firewall system integrity.
- Unvalidated input allows file overwrites.
- Complete firewall compromise is possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
The OPNsense firewall and routing platform is likely managed by infrastructure or platform teams. Given its role as a network edge device, security and network teams also have a vested interest. The immediate first step is to identify all OPNsense instances, confirm their business criticality and network exposure, and then pinpoint the accountable owner for each before planning remediation.
- Firewall and infrastructure teams own.
- Confirm OPNsense instance exposure.
- Plan remediation based on risk.
