Penetration Test Report (LogicalTrust): logicaltrust report opnsense 1.0

Security assessment of
OPNsense GUI, API and system
backend
LogicalTrust
www.logicaltrust.net
office@logicaltrust.net
Version 1.0
Date July 12, 2023
Authors
Radosław Chrzan
Marcin Graj
Łukasz Juszczyk
Mateusz Kocielski
Bartosz Kucharek
Borys Łącki
Feliks Penconek
Adam Piontek
Jakub Żukowski
Report version history
Version Date Description
0.1 05-07-2023 Draft report
1.0 12-07-2023 Final version after the retest
©2023 LogicalTrust Version 1.0 1/60
Contents
1 Table of findings 4
2 Penetration tests 5
2.1 Service specification . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2 Scope of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3 Hazardousness classification . . . . . . . . . . . . . . . . . . . . . . . 5
2.4 Common Vulnerability Scoring System . . . . . . . . . . . . . . . . . . . 6
2.5 Penetration tests effectiveness saving clause . . . . . . . . . . . . . . . . . 6
2.6 Penetration tests risk saving clause . . . . . . . . . . . . . . . . . . . . 6
2.7 Results summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 Future Directions 9
3.1 Source code audit . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2 Backend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2.1 Default configuration. . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.3 Plugins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.4 Logical flaws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4 List of vulnerabilities 10
4.1 CWE-79: Improper Neutralization of Input During Web Page Generation (’Cross-site
Scripting’). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.1.1 LT-0002 Reflected Cross-Site Scripting - Certificates - act FIXED . . . . . . . . 11
4.1.2 LT-0017 Reflected Cross-Site Scripting - Cron - /ui/cron/item/open/ FIXED . . . . 14
4.1.3 LT-0004 Reflected Cross-Site Scripting - Log Files - /ui/diagnostics/log/core/ FIXED . 16
4.1.4 LT-0011 Lack of input sanitization - crash_reporter.php FIXED . . . . . . . . . 19
4.1.5 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2 CWE-22: Improper Limitation of a Pathname to a Restricted Directory (’Path Traversal’) 24
4.2.1 LT-0014 Zip-slip in Captive Portal template upload leads to Remote Code Execution
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
FIXED
4.2.2 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
4.3 CWE-732: Incorrect Permission Assignment for Critical Resource . . . . . . . . . 30
4.3.1 LT-0003 Insecure directory permissions - /conf/ . . . . . . . . . . . . . . . 30
4.3.2 LT-0013 Insecure permissions - configd.socket . . . . . . . . . . . . . . . . 32
4.3.3 LT-0006 Services run as root . . . . . . . . . . . . . . . . . . . . . . 33
4.3.4 LT-0007 Insecure temporary file storage - /tmp/ usage . . . . . . . . . . . . 34
4.3.5 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.4 CWE-78: Improper Neutralization of Special Elements used in an OS Command (’OS
Command Injection’). . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.4.1 LT-0008 Command injection - Backups - diag_backup.php FIXED . . . . . . . . 38
4.4.2 LT-0016 Command injection - Cron - /api/cron/settings/setJob/ FIXED . . . . . 41
4.4.3 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.5 CWE-352: Cross-Site Request Forgery (CSRF) . . . . . . . . . . . . . . . . 46
4.5.1 LT-0001 Using GET method to modify application state FIXED . . . . . . . . . 46
4.5.2 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
©2023 LogicalTrust Version 1.0 2/60
4.6 CWE-601: URL Redirection to Untrusted Site (’Open Redirect’) . . . . . . . . . 48
4.6.1 LT-0005 Open Redirect - Login FIXED . . . . . . . . . . . . . . . . . . 48
4.6.2 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.7 CWE-209: Generation of Error Message Containing Sensitive Information. . . . . . 51
4.7.1 LT-0015 Verbose error messages . . . . . . . . . . . . . . . . . . . . . 51
4.7.2 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
4.8 Informative note . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
4.8.1 LT-0009 Custom message injection - system_usermanager.php WONTFIX . . . . . 55
4.8.2 LT-0010 Improper error handling WONTFIX . . . . . . . . . . . . . . . . . 57
4.8.3 Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
d0ff5974b6aa52cf562bea5921840c032a860a91a3512f7fe8f768f6bbe005f6
©2023 LogicalTrust Version 1.0 3/60
1 Table of findings
Risk level ID Vulnerability name Status
01. 0002 Reflected Cross-Site Scripting - Certificates - act Fixed
HIGH
02. 0017 Reflected Cross-Site Scripting - Cron - /ui/cron/item/open/ Fixed
HIGH
03. 0004 Reflected Cross-Site Scripting - Log Files - /ui/diagnostic- Fixed
HIGH
s/log/core/
04. 0014 Zip-slip in Captive Portal template upload leads to Remote Fixed
HIGH
Code Execution
05. 0008 Command injection - Backups - diag_backup.php Fixed
MEDIUM
06. 0016 Command injection - Cron - /api/cron/settings/setJob/ Fixed
MEDIUM
07. 0003 Insecure directory permissions - /conf/ New
MEDIUM
08. 0013 Insecure permissions - configd.socket New
MEDIUM
09. 0006 Services run as root New
MEDIUM
10. 0001 Using GET method to modify application state Fixed
MEDIUM
11. 0007 Insecure temporary file storage - /tmp/ usage New
LOW
12. 0011 Lack of input sanitization - crash_reporter.php Fixed
LOW
13. 0005 Open Redirect - Login Fixed
LOW
14. 0015 Verbose error messages New
LOW
15. 0009 Custom message injection - system_usermanager.php Won’t fix
INFO
16. 0010 Improper error handling Won’t fix
INFO
©2023 LogicalTrust Version 1.0 4/60
2 Penetration tests
2.1 Service specification
The following report presents results of an analysis of OPNsense platform1 security. The assessment was
focused on web GUI and API, but also parts of the system backend were investigated. Work has been
carried out in a period from June 12 to June 26, 2023. In total, around 120 hours were committed to the
project.
2.2 Scope of work
The working subject consisted of the following resources:
• OPNsense GUI OPNsense 23.1.9
• API OPNsense 23.1.9
• System backend OPNsense 23.1.9
Main task of the conducted technical operations, was the identification of as many as possible vulner-
abilities and security leaks which can pose a security threat for the confidentiality, integrity or accessibility
of processed data. Finally, security leaks can lead to inability in fulfilling the business tasks realized by the
above-mentioned applications and services.
2.3 Hazardousness classification
All of the vulnerabilities described in the report, were classified according to defined hazardousness cate-
gories and their identification confidence level. These categories build a contractual classification system,
designed to help Client while the priorities of the repair operations are assigned.
Definitions of particular risk levels:
• INFO – these vulnerabilities do not pose a direct threat, however they have been noted because they
depict the testing process and in the future they may influence the security levels of implemented
solutions.
• LOW – vulnerabilities of this type do not pose a direct threat for confidentiality, integrity or avail-
abilityofdataprocessedbythesystem. Thiskindoferrors, usuallyalloworfacilitateidentificationof
platform weak points, for example by disclosure of additional information about the working service.
• MEDIUM – vulnerabilities of this type lead to a loss of confidentiality, integrity, or accessibility
of processed data, but only under circumstances which significantly restrain the range of possible
attacks.
• HIGH – these vulnerabilities pose an imminent and significant threat of confidentiality, integrity, or
accessibility of processed data with additional circumstances that must occur for the attack to be
successful.
• CRITICAL – these vulnerabilities pose a direct and highly probable threat to a