abraxas/opnsense-wlan-wpa-lineOPNsense 26.7.6 - High - Remote - Config line injection - WLAN WPA identity
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · opnsense-wlan-wpa-line
Class: Config line injection Reach: Remote
OPNsense core 26.7.6 (a842fe48) - opnsense.org
Leftover of GHSA-fq94. Wireless SSID got AllowNewlines=N. identity, passphrase, and RADIUS auth_server_shared_secret stayed bare TextField (newlines on by default) and dump into /var/etc/wpa_supplicant_*.conf and /var/etc/hostapd_*.conf. interfaces.inc interpolates identity="{identity}" into the wpa_supplicant stanza. Newline or quote break adds extra directives as root. Privilege is page-interfaces-wireless-edit, not page-all.
| ID | no CVE yet |
| Class | Config line injection |
| Reach | Remote (authenticated WebGUI) |
| CWE | CWE-93 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | OPNsense core (Deciso B.V.) |
| Affected | OPNsense core 26.7.6 (a842fe48c21288d11a422cb944678e8eb308becf) Wlan.xml identity / passphrase |
| Auth | WebGUI session with page-interfaces-wireless-edit |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
I pinned tag 26.7.6. The lab is a PHP gadget of pinned interfaces_wlan_configure, loopback HTTP on 127.0.0.1:18840. Identity CR/LF wrote extra # OPNSENSE-WLAN-WPA-LINE-WITNESS. SSID stayed one line.
| Method | Sink | Privilege |
|---|---|---|
| identity CR/LF | pin interfaces_wlan_configure extra directive in wpa_supplicant conf | Integrity (lab-proven): extra # OPNSENSE-WLAN-WPA-LINE-WITNESS after identity. Lab: identity-newline=yes extra-directive=yes. |
honor of extra network / ssid / ap_scan / ctrl_interface | wpa_supplicant / hostapd as root | Integrity (inferred): extra daemon directives. wpa_supplicant not started in the gadget. |
| SSID CR/LF | AllowNewlines=N | Negative (lab-proven): SSID stayed one line. ssid-control=single-line. |
| passphrase / RADIUS secret CR/LF | hostapd_*.conf / wpa_supplicant | Integrity (inferred): same class. Gadget ran the identity path. |
| invalid extra directive | wireless daemons | Availability (inferred): hostapd / wpa_supplicant can fail to start. |
| this path | none | Recon: no extra read of config.xml secrets. |
Lab-proven vs inferred: identity newline extra directive and SSID single-line control are lab SUCCESS. hostapd and live daemon apply are inferred.
Requires: page-interfaces-wireless-edit. POST /api/interfaces/wireless_settings/*. Not page-all. CSRF token. Browser <input type="text"> will not keep CR/LF; a direct POST from that session will.
| Surface | Lab |
|---|---|
| SSID newline | constrained (ssid-control=single-line) |
| Unauth | closed |
page-all wireless admin | intended radio config; leftover is extra directives a delegated editor was not meant to mint |
| CVE-2025-50989 bridge span cmdi | now configdRun with no request token |
| WEP keys | escapeshellarg into ifconfig |
No unauth. SSID already rejects CR/LF. Full admin already has root by design.
cd lab
./run.sh
Loopback 127.0.0.1:18840. Compose project opnsense-wlan-wpa-line. Witness OPNSENSE-WLAN-WPA-LINE-WITNESS. Last line:
SUCCESS opnsense-wlan-wpa-line identity-newline=yes extra-directive=yes ssid-control=single-line OPNSENSE-WLAN-WPA-LINE-WITNESS
Set AllowNewlines=N on identity, passphrase, and RADIUS secrets, same as SSID. Strip CR/LF and quotes inside interfaces_wlan_configure so every caller is covered. Extra hostapd / wpa_supplicant directives belong behind page-all.
a842fe48c21288d11a422cb944678e8eb308becfWlan.xmlinterfaces.inc interfaces_wlan_configureAllowNewlines=N