CVE-2021-20022

SonicWall Email Security version 10.0.9.x contains an unrestricted file upload flaw (CWE-434) that allows a post-authenticated attacker to upload arbitrary files to the remote host. The flaw is reachable over the network but requires high-level privileges (CVSS 3.1 vector notes PR:H), so an attacker needs valid privileged access to the email security platform before they can abuse it. Successful exploitation lets the attacker place arbitrary files on the appliance or service, which can be leveraged toward further compromise; the associated campaign against SonicWall email appliances is known to have escalated to ransomware deployment. Any organization running SonicWall Email Security on version 10.0.9.x is affected, including the hardware appliance models (3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000), the virtual appliance, and the hosted service. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, as part of a broader campaign attacking SonicWall email appliances with multiple zero-days.

What to do: Apply the vendor's patched SonicWall Email Security release per SonicWall's update instructions and verify that hosted instances have been updated by the vendor; prioritize patching since the flaw is on CISA's KEV list with known ransomware use. Restrict management-interface access to trusted networks, rotate credentials for privileged Email Security accounts, and hunt for signs of compromise such as unexpected uploaded files, new administrative accounts, and ransomware indicators on appliances still running 10.0.9.x.