Chasing the OPNsense RCE: The Story Behind My First CVEs (CVE-2026-57155)

I think every security researcher remembers their first CVE. For me, that milestone did not arrive as a single, low-impact bug. Instead, during one of my designated security research weeks at Hacking Cult, my deep dive into OPNsense yielded five accepted vulnerabilities. This milestone was capped off by a critical Remote Code Execution flaw with a 9.9 CVSS rating (CVE-2026-57155).As a popular open-source FreeBSD-based firewall and routing platform, OPNsense sits at the edge of enterprise and home networks. The claim of OPNsense is to make digital security accessible to everyone by providing all the features of expensive commercial firewalls and more for free.As penetration testers at our company, we regularly have the opportunity to spend time on security research and professional development. Because we rely heavily on open-source software, we decided to use this time to conduct penetration tests to help improve the ecosystem. In a community poll, OPNsense was suggested as a target, a perfect fit!Over the course of five days, I was able to identify eight vulnerabilities. In the interest of responsible disclosure, this write-up will focus exclusively on the five that have already been patched. Of the remaining three, one was identified as a duplicate, while the other two are still under active review by the maintainers at the time of writing.FindingCVE/GHSASeverityRCE via Arbitrary File Write in GeoIP Alias ImporterCVE-2026-57155GHSA-wjqq-rfmm-v5h3Critical (9.9)XPath injection in MVC safe-deleteCVE-2026-58395GHSA-98h6-479q-9q3wMedium (4.3)Stored XSS in Services: NTP GPSCVE-2026-58392GHSA-h793-67jm-j4m5Medium (5.4)Stored XSS via

Polyglots are incredibly efficient for this type of black-box testing because a single payload is crafted to break out of multiple contexts simultaneously (e.g. escaping an HTML attribute, a JavaScript string and standard HTML tags all at once).Four Moderate VulnerabilitiesBefore telling you more details about the critical RCE I found, a few words about the other moderate vulnerabilities I discovered in my OPNsense audit. None of them allow you to get a root shell on their own, but each one tells you something about how the same class of mistake (trusting input without sanitization) shows up in different corners of the same codebase.XPath Injection in MVC Safe-DeleteAll “delete” buttons in the MVC-based modules of OPNsense eventually call the same generic safe-delete routine, which is shared by dozens of endpoints. So when I found that the delete token from the URL gets dropped straight into an XPath query with plain string interpolation, it did not affect one endpoint. It affected twenty-one!A payload as simple as ')or(' turns:1 $xpath = "//text()[contains(.,'{$token}')]"; into a query that matches every text node in config.xml. When it matches, the API throws an HTTP 500 error message with module, description and UUID of the matched node.A user with one privilege among several can use a safe-delete endpoint as a read oracle for modules they were never supposed to see. No data is changed, no deletion happens, but the config leaks through the error message anyway.Three Stored XSSThe remaining three findings are all stored XSS and what I find more interesting than any single payload is the pattern connecting them: in every case, the escaping happened in the wrong place.In the Firewall Rules and NAT grids, category names and alias descriptions land inside a title="..." attribute, but the backend only runs htmlspecialchars() with ENT_NOQUOTES, which blocks <, > and & but not the one double quote (") needed to close the attribute and inject an event-handler attribute like onanimationstart onto the existing <span>, which lets it execute JavaScript with zero user interaction.The NTP GPS page tries harder. It calls an escaper, but only on the base64-encoded form of the initialization command.

if country_code not in output_handles: output_handles[country_code] = open( '%s/%s-%s' % (cls._target_dir, country_code, proto), 'w') # line 90-91 - country_code WRITE SINK ... output_handles[country_code].write("%s\n" % parts[0]) # line 94 - content, from the blocks CSV country_code never gets validated. It goes straight from the CSV into a file path. Swap it for ../../../../../etc/newsyslog.conf.d/zzz_pwn and “one output file per country” becomes “one output file wherever I want”, with content taken directly from the network column of the blocks CSV. The one structural constraint the importer leaves standing is the -IPv4/-IPv6 suffix appended to every filename. And that single detail ends up shaping the entire rest of the exploit chain.The Exploit ChainThree authenticated API calls turn that write sink into a root shell. And all three only require a single privilege most admins would consider harmless to delegate: Firewall: Alias: Edit.POST /api/firewall/alias/set - stores an attacker-controlled URL as the GeoIP source in config.xml. There is no restriction on which host that URL can point to.POST /api/firewall/alias/reconfigure - re-renders /usr/local/etc/filter_geoip.conf, baking the URL of the attacker into the file the importer will read.POST /api/firewall/alias/update/geoip - triggers the configd update.geoip action, which runs geoip.py as root. It fetches my malicious archive and unpacks it with the vulnerable country_code logic.That is already an arbitrary root file write, with one catch: every filename ends in -IPv4 or -IPv6. Normally that kind of forced suffix kills a path-traversal write. You can not simply drop a working PHP web shell or crontab line if the filename has to end in a useless suffix.

But after some reconnaissance on the OPNsense FreeBSD operating system, I discovered that the default /etc/crontab runs newsyslog every hour as root and newsyslog reads every file matching /etc/newsyslog.conf.d/* (this includes our -IPv4 and -IPv6 suffixes!).To abuse this, the exploit writes two files:/etc/newsyslog.conf.d/zzz_pwn-IPv4 - a newsyslog entry with an R (run-command) action, so newsyslog executes an arbitrary shell command whenever this log line “rotates”./var/log/rotate_bait-IPv4 - a log file with a size of at least 1KB, so the size-based rotation trigger of newsyslog fires the next time it runs.On the full hour, the root cronjob rotates the oversized log file and executes the injected command. All from an account that was only ever supposed to be allowed to edit firewall aliases.Proof of ConceptLegal Notice: This is for educational purposes! (Do not use this illegally!)You can get the full Proof of Concept in my Ampferl/security repository. Here I will just show the parts that carry the actual exploit idea.First, the traversal targets and the newsyslog payload itself:1 2 3 4 5 6 7 8 9 10 11 12 13 14 # traversal targets (geoip.py appends '-IPv4'/'-IPv6') (the traversed dirs must already exist) TRAVERSE = "../../../../../../../.." CONF_PATH = f"{TRAVERSE}/etc/newsyslog.conf.d/zzz_pwn" LOG_PATH = f"{TRAVERSE}/var/log/rotate_bait"

# Stage-1: the newsyslog `R` command