OPNsense GeoIP Alias Importer Path Traversal Enables Root Code Execution

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

• OPNsense core 26.1 branch: versions <= 26.1.10 are affected; 26.1.11 is identified as fixed. • OPNsense core 26.4 branch: the vendor advisory identifies versions <= 26.4.1 as affected; 26.4.1p1 is identified as fixed. • The normalized record initially listed only < 26.1.11; the 26.4 branch was added by the OPNsense advisory and must be treated as a separate affected branch. • The evidence does not establish the status of other branches, so later or parallel versions must not be assumed unaffected.

The OPNsense Firewall Alias GeoIP importer processes ZIP and gzip archives through process_zip() and process_gzip() in src/opnsense/scripts/filter/lib/alias/geoip.py. It uses the CSV country_code value directly to construct output filenames below /usr/local/share/GeoIP/alias without constraining the result to that directory, allowing attacker-controlled CSV data to escape the intended path. File content comes from the archive's network field, and the write is performed as root; every generated filename receives an -IPv4 or -IPv6 suffix. A user with Firewall: Alias: Edit can configure a GeoIP URL controlled by the attacker and trigger the update flow so OPNsense downloads the archive and runs the importer with root privileges. The advisory describes a follow-on chain that uses a newsyslog configuration fragment and the default hourly cron job to reach root code execution. Whether customized deployments retain the default newsyslog configuration is not established, but arbitrary root file write is the confirmed core outcome.

The vulnerability is reachable remotely through the OPNsense web interface. An attacker needs an authenticated account with Firewall: Alias: Edit, but does not need full administrative access or interaction from another user. The supplied profile describes low attack complexity and no user interaction. Exploitation requires an attacker-controlled GeoIP source URL and a specially crafted archive, followed by the configuration, reconfigure, and GeoIP update operations. The GitHub advisory and public technical write-up document a proof of concept covering both the ZIP and gzip processing paths. Public exploit material is confirmed, but the available evidence does not establish in-the-wild exploitation or identify a campaign, victim, or breach.

The vulnerability lets an authenticated user with Firewall: Alias: Edit cause the GeoIP update process to write arbitrary files with root privileges into existing directories. This crosses from alias-management scope into operating-system scope and can affect the firewall's confidentiality, integrity, or availability. The described newsyslog chain can turn the root file-write primitive into root code execution, equivalent to complete device compromise. The exact escalation depends on directories and local configuration present on the target, but the confirmed root file write alone requires serious incident-response treatment.

• A delegated account allowed to edit Firewall Alias data can cross its intended privilege boundary and affect the firewall operating system as root. • The attacker can write arbitrary content into existing directories, potentially changing device configuration, data, or operating behavior. • The published newsyslog chain can lead to root code execution, placing the firewall's confidentiality, integrity, and availability at serious risk. • Loss of firewall control could weaken the network security boundary and disrupt service, but the available evidence does not confirm a specific intrusion or data loss event.

1. Upgrade the 26.1 branch to exactly 26.1.11. For the 26.4 branch, upgrade to exactly 26.4.1p1. Do not replace the branch-specific guidance with an assumption that one fixed release covers every other branch.
2. If an upgrade cannot be completed immediately, temporarily restrict Firewall: Alias: Edit to accounts that genuinely require it and prevent untrusted users from changing the GeoIP source URL.
3. Review existing GeoIP URLs and replace uncontrolled sources with trusted sources while the upgrade is pending. This is a temporary risk reduction, not a replacement for the fix.
4. If the fix must be backported, apply the change to both process_zip() and process_gzip(). The OPNsense fix validates that country_code is exactly two characters and contains only alphanumeric characters before using it to build a filename.
5. After upgrading, recheck alias permissions, GeoIP source URLs, and unexpected files in newsyslog configuration directories before returning the device to normal operation.

1. Inventory running OPNsense versions and identify devices on affected branches before comparing them with the corresponding fixed release.
2. Review accounts and groups granted Firewall: Alias: Edit, especially non-administrative accounts, and examine recent changes to GeoIP source URLs.
3. Review access and audit logs for firewall/alias/set, firewall/alias/reconfigure, and firewall/alias/update/geoip for unusual sequences, particularly when the source URL points to an external or untrusted host.
4. Inspect /usr/local/share/GeoIP/alias and other sensitive directories for unexpected files or content, and verify file ownership and creation times.
5. Review /etc/newsyslog.conf.d/ and related log files for unexpected fragments or files with -IPv4 or -IPv6 suffixes. This is precautionary monitoring based on the published chain, not a confirmed IOC for every attack.
6. If root-owned file creation or newsyslog configuration changes are found, isolate the device and investigate it as potentially fully compromised; the absence of matching log evidence does not prove that the system is safe.